CVE-2026-55606: falha de média gravidade em openwrt odhcpd
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.4%
probabilidade de exploração
0.4%top 68% das CVEs
exploração observada
nãonenhuma fonte reporta
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
openwrt · odhcpdCVEs relacionadas — openwrt odhcpd
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53921CRITICALodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)EPSS 1.1%CVE-2026-53922MEDIUModhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)EPSS 0.6%CVE-2026-53918HIGHodhcpd DHCPv6 IA dangling first pointer use-after-freeEPSS 0.5%CVE-2026-53920HIGHodhcpd DHCPv6 Short IA_NA/IA_PD Body Stack DisclosureEPSS 0.4%