External risk intelligence

Mercury D196G Buffer Overflow Vulnerability in Password Parameter.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-50401

The vulnerable product is a Mercury D196G router. Routers are typically deployed as internet-facing edge devices that manage network traffic. Because the vulnerability involves a password parameter in a web-based interface or management service, it is commonly accessible from the network edge in standard deployment configurations.

Buffer Overflow

Mercurycom D196g Firmware

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Mercury D196G devices, potentially allowing unauthorized access and control. This issue stems from a buffer overflow vulnerability in the password handling function, which could enable attackers to compromise the device if exploited. The main concern is confirming the relevance and exposure of these devices within your network.

Weak password handling may allow unauthorized access.
Routers are typically internet-facing, increasing risk.
Confirm device relevance and exposure to this vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target the Mercury D196G router's firmware without needing any prior access or authentication. By sending specially crafted data to the `password` parameter, they can trigger a buffer overflow vulnerability in the `sub_404CAEDC` function. Successful exploitation could allow an attacker to compromise the router's confidentiality, integrity, and availability.

No authentication or privileges needed.
Triggered by a password parameter input.
Allows unauthorized access and control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the device by sending a specially crafted password. This could impact the device's core functions and potentially lead to broader network compromise.

Device functionality and integrity.
Network-based input to a password parameter.
Arbitrary code execution and system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Mercury D196G router, specifically its firmware, is affected by a critical buffer overflow vulnerability. Given that routers are typically internet-facing edge devices, security and network teams should prioritize identifying all deployed D196G units, assessing their network exposure, and confirming their business criticality. The first practical step involves locating all instances of this firmware, determining their accessibility, and identifying the accountable owner to plan a risk-based remediation strategy.

Owner: Network or Security Teams
Verify: Device exposure and criticality.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mercury D196G?

The Mercury D196G is a network router. These devices serve as a gateway for local networks, managing traffic flow between connected devices and the broader internet. Because they sit at the edge of a network, they are often the first point of contact for external traffic.

What does this buffer overflow vulnerability mean?

This flaw, classified as CWE-120, happens when a program writes more data to a memory area than it can hold. For CVE-2025-50401, the specific function handling password input fails to limit the data size. This can overwrite adjacent memory, potentially allowing an attacker to take control of the router's behavior.

How is the buffer overflow triggered?

An attacker triggers this by sending a specially formatted string to the password parameter in the device's management interface. Importantly, this does not require an attacker to have a valid account or password beforehand, nor does it require any prior system privileges to initiate the attack.

Is my Mercury D196G device at risk?

Halo Surface Signal indicates that because the D196G is a router, it is frequently deployed as an internet-facing device. Since the vulnerable password parameter is accessible via the network, any unit exposed directly to the internet is at higher risk compared to those limited to internal, isolated segments.

What should I do if I use this router?

First, conduct an inventory to identify all Mercury D196G units in your environment. Check if these devices are accessible from the internet and evaluate how critical they are to your operations. Once located, coordinate with your network or security team to plan a strategy for securing these assets.

References

github.com/sezangel/IOT-vul/tree/main/Mercury/D196G/1

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.