Read the docs
TI-2025-38766 Aliases CVE-2025-62526

OpenWrt ubusd vulnerable to heap buffer overflow

Priority LOW 34CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed openwrt (openwrt): 24.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtopenwrtbefore 24.10.424.10.4Patch availableCNA
  • openwrt Vendoropenwrt Affected before 24.10.4 Fixed in 24.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*before 24.10.4Vulnerableopenwrt
  • cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:* Versions before 24.10.4 Vulnerable ·openwrt

Remediation

  • Fix · CNA openwrt (openwrt) Fixed in 24.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62526

References

Patch 6

Advisory 1

  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-44983 Cross-site scripting in openwrt CVSS 3.1CRITICAL 9.6
  • TI-2026-40045 OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2023-09914 LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored… CVSS 3.1MEDIUM 5.4
  • TI-2026-44982 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download CVSS 3.1MEDIUM 4.9
  • TI-2026-23701 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup CVSS 4.0CRITICAL 9.5
See all 136 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences