| Title | eeroOS Ethernet Interface Denial of Service Vulnerability |
|---|
| Description | If eero Pro 5 devices receive an IPv6 packet where the payload length is zero and contains a hop-by-hop or destination options extension header that refers to another hop-by-hop or destination options extension header that doesn't exist (because the packet ends before providing the content for it) then the Ethernet interface will stop receiving any further packets. Transmission over Ethernet, and all WiFi communication unaffected. The effect is not permanent and the device can be rebooted to recover immediately.
The packet can be unicast or multicast and does not need to be directed at the eero's MAC or IPv6 address. In theory, if a unicast packet with these characteristics could be routed over the Internet to an IPv6 host on the WiFi network then it could be used to target eero devices remotely. In practise it does not appear to be possible to get such a packet through a bridge/router because it is malformed. |
|---|
| Source | ⚠️ https://github.com/nomis/eero-zero-length-ipv6-options-header-dos |
|---|
| User | Anonymous User |
|---|
| Submission | 09/30/2023 22:40 (3 years ago) |
|---|
| Moderation | 10/01/2023 08:00 (9 hours later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 241024 [eeroOS up to 6.16.4-11 Ethernet Interface denial of service] |
|---|
| Points | 20 |
|---|