CVE-2026-10825
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
Risk Assessment
This vulnerability can lead to service outages, affecting the availability of systems within the organization. Low-privileged attackers may exploit this flaw to disrupt device operations.
Recommendation
It is recommended to implement additional validation and handling of JSON requests in the WebSocket API to minimize the risk of attacks. Monitoring logs for suspicious activities is also advised.
Other vulnerabilities in WebSocket API
See all- CVE-2026-97363High
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.
- CVE-2026-7703High
A flaw has been found in AV Stumpfl Pixera Two Media Server up to version 25.2 R2 in an unknown function of the Websocket API component, allowing for code injection. The attack can be initiated remotely.
Original NVD description (English source)
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reboot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS