CVE-2026-42799

High

Published: 30 April 2026

Published

30 April 2026

Modified

05 May 2026

KEV Added

—

Patch

—

CVSS Score 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS Score 0.0005 14.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-42799 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Asrmicro Asr1803 Firmware. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mandates timely identification, reporting, and remediation of flaws like this out-of-bounds read in nr_fw modules by applying vendor patches to Kestrel versions on or after 2026/02/10.

SI-16 Memory Protection partial match

prevent

Provides runtime memory protections such as bounds checking and address space layout randomization to mitigate exploitation of out-of-bounds read vulnerabilities in firmware like NrPwrCtrl.C.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Supports vulnerability scanning to identify systems running affected Kestrel versions prior to 2026/02/10 vulnerable to this remote out-of-bounds read.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Remote network exploitation of the out-of-bounds read vulnerability in the exposed firmware module with low privileges and no user interaction directly enables initial access via exploitation of a public-facing application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. This issue affects Kestrel: before 2026/02/10.

Deeper analysisAI

CVE-2026-42799 is an out-of-bounds read vulnerability (CWE-125) in the ASR Kestrel nr_fw modules, specifically associated with the program file Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. This issue allows overflow buffers and affects Kestrel versions prior to 2026/02/10. The vulnerability was published on 2026-04-30.

The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). It can be exploited remotely over the network by an attacker possessing low privileges, with low attack complexity and no user interaction required. Exploitation changes scope and results in low impacts to confidentiality, integrity, and availability.

Mitigation guidance is provided in the vendor advisory at https://www.asrmicro.com/en/goods/psirt?cid=44. Affected Kestrel installations should be updated to versions on or after 2026/02/10.