CVE-2025-62526 in OpenWrt Project
Summary
by MITRE • 10/22/2025
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/28/2025
The vulnerability CVE-2025-62526 represents a critical heap buffer overflow within the ubus daemon of OpenWrt versions prior to 24.10.4, specifically affecting the event registration parsing functionality. This flaw exists in the ubusd component which serves as the core communication daemon for OpenWrt embedded systems, facilitating inter-process communication through a Unix domain socket interface. The vulnerability stems from improper input validation during the parsing of event subscription requests, where maliciously crafted data can exceed the allocated buffer boundaries and corrupt adjacent memory regions. This type of vulnerability falls under CWE-121 heap-based buffer overflow, which is particularly dangerous as it can lead to arbitrary code execution when memory corruption occurs.
The technical exploitation of this vulnerability occurs through the ubus daemon's event subscription mechanism, which operates without prior access control checks during the parsing phase. This design flaw allows any unauthenticated ubus client to send specially crafted subscription messages that trigger the buffer overflow condition, effectively bypassing the normal access control list validation that should occur before processing such requests. The ubus daemon's architecture processes these subscription requests before performing any ACL checks, creating a window where an attacker can manipulate the daemon's memory state and potentially gain code execution privileges. This vulnerability is particularly severe because it affects the core system daemon that manages all communication between different system components, making it a prime target for attackers seeking persistent access to embedded devices.
The operational impact of CVE-2025-62526 extends beyond simple memory corruption, as it enables attackers to bypass the listen ACL protection mechanisms that are designed to restrict which clients can subscribe to specific events. This means that an attacker can not only execute arbitrary code on the ubus daemon but also gain access to sensitive system information and events that should normally be restricted. The vulnerability affects all ubus clients, including those that are typically considered trusted or that operate with elevated privileges, since the flaw exists in the parsing layer that processes all incoming subscription requests regardless of their source. This creates a significant risk for embedded network devices running affected OpenWrt versions, as attackers can compromise the entire system through this single vulnerability without requiring additional authentication or privilege escalation techniques.
The exploitation of this vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter, specifically focusing on the ubus daemon as a target for code execution. The heap buffer overflow can be leveraged to overwrite function pointers, return addresses, or other critical memory structures within the ubus daemon process, potentially allowing for remote code execution in the context of the daemon with its elevated privileges. Security practitioners should note that this vulnerability represents a classic example of a pre-authentication remote code execution flaw in embedded system daemons, where the lack of proper input validation during early processing stages creates exploitable conditions. The fix implemented in OpenWrt 24.10.4 involves proper bounds checking and input validation within the ubus event registration parsing code, addressing both the heap corruption and ACL bypass aspects of the vulnerability. Organizations running affected OpenWrt versions should prioritize immediate upgrade to 24.10.4 or later, as no effective workarounds exist for this particular flaw due to its nature in the early processing stages of the ubus daemon.