Cisco Meraki firmware: Incorrect calculation (CWE-682) in hardening release

Summary

Several Cisco Meraki product lines, including MR access points, MS switches, MV cameras, MX security appliances, MG cellular gateways and Campus Gateways, are affected by incorrect calculation weaknesses such as integer overflow. Cisco grouped these internally found issues under this CVE. An attacker on the same network segment can exploit the flaw without credentials or user interaction, with a CVSS score of 8.8 indicating high impact on confidentiality, integrity and availability.

Affected

• Cisco Meraki MR, MS, MV, MX and MG products and Cisco Campus Gateway software, as listed in advisory cisco-sa-hardening-meraki-os-drbEX9GH.
• The exact affected releases for this CVE are Unknown. The CVE record lists versions for MR, MV, MX and Campus Gateway, but the per-CVE mapping has not been confirmed in the advisory.

Fixed in

• MR: 30.7.3, 31.1.8.1, 32.2.5, 33.1.3
• MS: 18.1.9 (MS 17.2 and 18.1 branches)
• Campus Gateway: 32.2.5 (planned late October 2026), 33.1.4 (planned mid-November 2026)
• MG: 26.1.4 (4.1.4 for MG21/E only)
• MV: 8.0
• MX: 18.107.14 (if offered), 19.2.9 (Z3 only), 26.1.7, 26.2.3
• Some fixed releases were still pending at the time of the advisory; verify availability before rollout.

Workaround

• Cisco states that no workarounds are available.
• Interim measure (own recommendation): restrict management access and limit which network segments can reach affected devices until firmware is applied.

Exploitation

• Cisco PSIRT is not aware of public announcements or malicious use.
• The issues were found during internal testing.
• CISA SSVC data: exploitation none, automatable no.

Our recommendation

• Inventory all Cisco Meraki devices and their firmware versions.
• Patch each device to the fixed release for its product line as stated in the advisory, prioritising the MR, MX and MS devices in the next maintenance window.
• Track devices whose fixes are still pending separately.
• Limit adjacent-network access, for example guest, IoT and shared segments, to affected devices.
• Monitor for vendor updates and exploitation reports.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-meraki-os-drbEX9GH sec.cloudapps.cisco.com
• OpenCVE: CVE-2026-76470 (CISA SSVC data) app.opencve.io
• Cisco Security Advisory notice cisco-sa-notice-fBn58ELx www.cisco.com
• Vulners: Rapid7 record for CVE-2026-76470 vulners.com
• eSecurityPlanet: Cisco Meraki security hardening news www.esecurityplanet.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:17.