CVE-2026-102212— Pre-Auth Heap Buffer Overflow in the Multipart Request

Quick assessment

Affected

Opengear IM7200

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Opengear IM72XX、CM71XX 和 ACM70XX 系列控制台服务器设备在固件版本 4.8.0 至 5.5.2 中存在基于堆的缓冲区溢出漏洞。该漏洞允许未经身份验证的远程攻击者通过构造一个包含超长 Content-Disposition 名称字段的 multipart/form-data POST 请求，导致 index.cgi 进程崩溃。

CVSS 8.4 · High EPSS 0.32% · P25 Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Opengear	ACM7000	`4.8≤ 5.5.2`	affected
Opengear	CM7100	`4.8≤ 5.5.2`	affected
Opengear	IM7200	`4.8≤ 5.5.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Pre-Auth Heap Buffer Overflow in the Multipart Request

Source: CVE Program / CVE List V5

Vulnerability Description

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/S:P/AU:Y/RE:L/U:Red

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Opengear	IM7200	4.8 ~ 5.5.2	-
Opengear	CM7100	4.8 ~ 5.5.2	-
Opengear	ACM7000	4.8 ~ 5.5.2	-

II. Public POCs for CVE-2026-102212

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102212

请登录查看更多情报信息。

Other References for CVE-2026-102212 (2)

https://www.cve.org/CVERecord?id=CVE-2026-102212

IV. Related Vulnerabilities

Same weakness: CWE-122