External risk intelligence

Mercury D196G Firmware Buffer Overflow in fac_password Function.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-50398

This CVE affects a Mercury D196G router firmware. Routers and networking appliances of this type are commonly deployed as internet-facing edge devices, making their management interfaces or web-based configuration parameters frequently reachable from the public internet.

Buffer Overflow

Mercurycom D196g Firmware

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Mercury D196G router firmware, specifically related to a buffer overflow in the password handling function. This flaw could allow unauthorized individuals to gain control of the affected devices. The main concern at this time is confirming if this technology is in use within our environment and, if so, to what extent it might be exposed.

Issue: Flaw in router password handling.
Remember: Affects common internet-facing devices.
Takeaway: Confirm if this router is deployed internally.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request over the network to a vulnerable Mercury D196G device. The request would target the `fac_password` parameter within a specific function, potentially leading to a buffer overflow. This overflow could allow an attacker to execute arbitrary code or disrupt the device's operation.

No special access needed.
Triggered via network request.
Risk of code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to remotely execute code by sending a specially crafted `fac_password` parameter to a vulnerable device. When supported by the advisory, this could impact the device's availability, integrity, and confidentiality.

Device control and data at risk.
Remote code execution via password parameter.
Device compromise and potential network impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Mercury D196G firmware, specifically a buffer overflow exploitable via the `fac_password` parameter, likely impacts network infrastructure teams managing edge devices. The first practical step is to identify all deployed D196G devices, determine their internet reachability and business criticality, and then assign ownership for risk-based remediation planning.

Ownership: Network and infrastructure teams.
Verify first: Device exposure and business criticality.
Action: Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mercury D196G?

The Mercury D196G is a networking device that runs firmware to manage connectivity. It typically functions as a router, acting as a gateway that directs traffic between a local network and the internet. Users rely on this hardware to manage their home or office network configurations, often interacting with it through a web-based interface built into the firmware.

How does this CVE-2025-50398 buffer overflow work?

This vulnerability is classified as CWE-120, a classic buffer overflow. It occurs when a program tries to store more data in a temporary storage area, or buffer, than it was designed to hold. In this case, providing an excessively long input to the 'fac_password' parameter overwrites adjacent memory, which can cause the device to crash or allow an attacker to run their own code instead of the intended software instructions.

Do I need to be logged in to trigger this bug?

No. The vulnerability does not require authentication or special user permissions to be triggered. An attacker can initiate the exploit by sending a specially crafted network request to the device. Note that the bug is specifically triggered through the 'fac_password' parameter; standard browsing traffic or using the device for normal internet connectivity does not trigger the overflow.

Why is this device considered high risk?

According to Halo Surface Signal, the Mercury D196G is frequently deployed as an edge device. Because these routers are often positioned at the boundary between internal networks and the public internet, their management interfaces are frequently reachable by anyone online. This network-facing nature increases the probability that an unauthorized actor can reach the vulnerable function remotely.

What is the first step to address CVE-2025-50398?

Start by performing an internal audit to locate all deployed Mercury D196G units. Once you have an inventory, determine which devices are connected to the internet and assess their business criticality. This information allows network and infrastructure teams to prioritize which routers need remediation first and ensures that subsequent security updates are applied in a coordinated, risk-based manner.

References

github.com/sezangel/IOT-vul/tree/main/Mercury/D196G/2

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.