Format String Vulnerability in Netopeer2 Server

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63201

Affected Vendors & Products

Vendor	Product	Version / Range
CESNET	netopeer2	< 2.8.21

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This vulnerability in Netopeer2 allows a low-privileged authenticated NETCONF user to remotely crash the netopeer2-server by sending a get RPC with an invalid subtree filter containing format specifiers. The issue occurs when the server processes the invalid input through logging functions, causing it to interpret attacker-controlled format sequences and read invalid pointers, leading to a denial of service.

Impact Analysis

The vulnerability can cause the netopeer2-server to crash, disrupting network configuration management services. While remote code execution was not confirmed, the denial of service could lead to service unavailability, affecting network operations dependent on NETCONF.

Mitigation Strategies

Upgrade netopeer2 to version 2.8.21 or later, as this vulnerability is patched in these releases. The advisory specifically identifies 2.8.8 as patched, but public release 2.8.21 is confirmed fixed.

Hi! I’m here to help you understand CVE-2026-63201. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70