CVE-2026-102212 PUBLISHED

Pre-Auth Heap Buffer Overflow in the Multipart Request

Assigner: Digi
Reserved: 28.09.2026 Published: 31.10.2026 Updated: 31.10.2026

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/RE:L/U:Red
CVSS Score: 8.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	High	Integrity	High	Integrity	High
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Opengear
Product	IM7200
Versions	Default: unaffected affected from 4.8 to 5.5.2 (incl.)

Vendor	Opengear
Product	CM7100
Versions	Default: unaffected affected from 4.8 to 5.5.2 (incl.)

Vendor	Opengear
Product	ACM7000
Versions	Default: unaffected affected from 4.8 to 5.5.2 (incl.)

CVE-2026-102212 PUBLISHED

Pre-Auth Heap Buffer Overflow in the Multipart Request

Metrics

Product Status

Credits

References

Problem Types