A critical stack-based buffer overflow in Mercury KM08-708H GiGA WiFi Wave2 firmware allows remote, unauthenticated attackers to potentially achieve full system compromise.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered within the HTTP Header Handler component. An unauthenticated remote attacker can supply a malicious Host header to corrupt memory and potentially execute arbitrary code.

The CVSS score of 9.8 indicates a critical severity level, reflecting the potential for total system compromise without requiring user interaction or authentication. Successful exploitation may lead to full device takeover, enabling attackers to intercept network traffic, pivot into internal environments, or disrupt critical connectivity services.

Immediate Action: As no patch version is currently specified, administrators should restrict network access to the management interface of the affected device and consider disabling remote HTTP access if possible.

Proactive Monitoring: Monitor device logs for unusual HTTP traffic patterns, specifically focusing on excessively long or malformed Host header strings originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block inbound HTTP requests containing suspicious or oversized Host header fields.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub repository.

The severity of this flaw cannot be overstated, as it provides a direct path for remote, unauthenticated code execution. Organizations utilizing the Mercury KM08-708H GiGA WiFi Wave2 must prioritize isolating these devices from external networks until a vendor-supplied firmware update is verified and applied.