CVE-2026-42799
Published: 30 April 2026
Summary
CVE-2026-42799 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Asrmicro Asr1803 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-42799 is an out-of-bounds read vulnerability (CWE-125) in the ASR Kestrel nr_fw modules, specifically associated with the program file Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. This issue allows overflow buffers and affects Kestrel versions prior to 2026/02/10. The vulnerability was published on 2026-04-30.
The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). It can be exploited remotely over the network by an attacker possessing low privileges, with low attack complexity and no user interaction required. Exploitation changes scope and results in low impacts to confidentiality, integrity, and availability.
Mitigation guidance is provided in the vendor advisory at https://www.asrmicro.com/en/goods/psirt?cid=44. Affected Kestrel installations should be updated to versions on or after 2026/02/10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26358
Vulnerability details
Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. This issue affects Kestrel: before 2026/02/10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation of the out-of-bounds read vulnerability in the exposed firmware module with low privileges and no user interaction directly enables initial access via exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and remediation of flaws like this out-of-bounds read in nr_fw modules by applying vendor patches to Kestrel versions on or after 2026/02/10.
Provides runtime memory protections such as bounds checking and address space layout randomization to mitigate exploitation of out-of-bounds read vulnerabilities in firmware like NrPwrCtrl.C.
Supports vulnerability scanning to identify systems running affected Kestrel versions prior to 2026/02/10 vulnerable to this remote out-of-bounds read.