CVE Intelligence

Openwrt vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Openwrt products: 63 record(s), with severity, exploitation and fixes.

Openwrt 46Luci 13Odhcpd 1Luci-proto-openvpn 1Luci-app-tailscale-community 1Luci-app-travelmate 1Travelmate 1Luci-app-banip 1Luci-app-adblock-fast 1

Exploited only (KEV) →

CVE-2026-30871 Critical · 9.8 CWE-121 Mar 19, 2026
OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (name_buffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPE_PTR queries. The overflow is possible because dn_expand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), significantly inflating the expanded name beyond the stack buffer's capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1.
CVE-2026-20435 Medium · 4.6 CWE-522 Mar 2, 2026
Insufficiently Protected Credentials in Linuxfoundation Yocto
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
CVE-2026-20430 High · 8.8 CWE-787 Mar 2, 2026
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00467553; Issue ID: MSV-5151.
CVE-2026-20419 Medium · 6.5 CWE-754 Feb 2, 2026
Improper Check for Unusual or Exceptional Conditions in Mediatek Nbiot Sdk
In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461663 / WCNCR00463309; Issue ID: MSV-4852.
CVE-2026-20408 High · 8.8 CWE-787 Feb 2, 2026
Out-of-bounds Write in Mediatek Software Development Kit
In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758.
CVE-2025-20765 Medium · 4.7 CWE-362 Dec 2, 2025
Race Condition in Linuxfoundation Yocto
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
CVE-2025-20748 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432679; Issue ID: MSV-3950.
CVE-2025-20747 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Linuxfoundation Yocto
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.
CVE-2025-20746 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Linuxfoundation Yocto
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.
CVE-2025-20742 High · 8.0 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00432680; Issue ID: MSV-3949.
CVE-2025-20741 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00434422; Issue ID: MSV-3958.
CVE-2025-20739 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435340; Issue ID: MSV-4038.
CVE-2025-20738 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435342; Issue ID: MSV-4039.
CVE-2025-20737 High · 7.8 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435343; Issue ID: MSV-4040.
CVE-2025-20736 Medium · 6.7 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049.
CVE-2025-20735 High · 7.8 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435349; Issue ID: MSV-4051.
CVE-2025-20734 Medium · 5.3 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441507; Issue ID: MSV-4112.
CVE-2025-20733 High · 7.8 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00441509; Issue ID: MSV-4138.
CVE-2025-20732 Medium · 5.3 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441510; Issue ID: MSV-4139.
CVE-2025-20731 Medium · 5.3 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441511; Issue ID: MSV-4140.
CVE-2025-20730 Medium · 6.7 CWE-287 Nov 4, 2025
Improper Authentication in Linuxfoundation Yocto
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141.
CVE-2025-20729 Medium · 4.2 CWE-787 Nov 4, 2025
Out-of-bounds Write in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441512; Issue ID: MSV-4153.
CVE-2025-62526 High · 7.8 CWE-122 Oct 22, 2025
OpenWrt ubusd vulnerable to heap buffer overflow
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.
CVE-2025-62525 High · 8.8 CWE-20 Oct 22, 2025
OpenWrt vulnerable to local privilage escalation
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds.
CVE-2025-20724 Medium · 5.5 CWE-125 Oct 14, 2025
Out-of-bounds Read in Mediatek Software Development Kit
In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418894; Issue ID: MSV-3475.