Executive Summary

CVE-2025-62526 is a high-severity vulnerability in the OpenWrt package 'ubusd' prior to version 24.10.4. It is a heap buffer overflow in the event registration parsing code, which allows an attacker to corrupt the heap and potentially execute arbitrary code within the context of the ubus daemon. This vulnerable code runs before access control checks, so any ubus client can exploit it. Additionally, the crafted subscription used to trigger the overflow bypasses the listen ACL, increasing the attack surface. The vulnerability requires low privileges and no user interaction. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with local access and low privileges to execute arbitrary code within the ubus daemon, potentially leading to system compromise. It can cause heap corruption and bypass access controls, which may result in unauthorized actions or denial of service. The confidentiality and integrity impacts are low, but the availability impact is high, meaning it can disrupt the normal operation of the affected device. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the OpenWrt ubusd package to version 24.10.4 or later, where the heap buffer overflow and ACL bypass issues have been fixed. There are no workarounds available, so applying the official security update is necessary to protect your system. [1]

Useful 0 Not Useful 0