Pre-Auth Heap Buffer Overflow in the Multipart Request

Summary

Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.

Remediation

1. Inventory every Opengear IM7200 deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://portal.opengear.com/customerservice/s/article/Release-Notification-Firmware-Version-5-5-3-is-Now-Generally-Available
• Advisoryhttps://portal.opengear.com/customerservice/s/article/CVE-2026-102212-Opengear-Console-Server-Buffer-Overflow-to-RCE