A heap‑based buffer overflow exists in the console server firmware of Opengear devices. Unauthenticated attackers can send a crafted multipart/form‑data POST request with an excessively long Content‑Disposition name field, causing the index.cgi process to crash. The failure to handle the malformed request appropriately can result in repeated service interruptions or a potential denial of service for the console interface.

The vulnerability affects Opengear ACM7000, CM7100, and IM7200 appliances running firmware versions 4.8.0 through 5.5.2. The affected firmware includes the console server component that processes multipart/form‑data requests.

The CVSS score of 8.4 indicates a high severity vulnerability, but the EPSS score is not available and the issue is not listed in CISA's KEV catalog. The attack vector is unauthenticated and remote, relying on the ability to send a crafted HTTP request. While the immediate impact is a crash of the index.cgi process, the lack of detection of additional exploitation pathways in the description keeps the likelihood of further compromise uncertain; nevertheless, because the flaw can lead to repeated downtimes, the overall risk remains high.