High · published October 22, 2025
⚡ A heap buffer overflow in ubusd can let attackers execute arbitrary code - think of it as leaving the front door of your smart home wide open! 🔥 Imagine if a delivery driver could enter your house and rearrange all your furniture just by having the right package slip—this vulnerability allows an attacker to do just that with your device's code due to faulty event registration parsing. This flaw could lead to an attacker taking complete control of the ubus daemon, essentially allowing them to manipulate your embedded device any way they want. The consequences could be absolutely devastating, from data exfiltration to complete device takeover, risking privacy and functionality.
Imagine if a delivery driver could enter your house and rearrange all your furniture just by having the right package slip—this vulnerability allows an attacker to do just that with your device's code due to faulty event registration parsing. Before version 24.10.4, the ubusd in OpenWrt had a heap buffer overflow in its event registration parsing code, leading to potential arbitrary code execution as it skipped crucial ACL checks.
This flaw could lead to an attacker taking complete control of the ubus daemon, essentially allowing them to manipulate your embedded device any way they want. The consequences could be absolutely devastating, from data exfiltration to complete device takeover, risking privacy and functionality. Immediately update OpenWrt to version 24.10.4 to patch this vulnerability, as there are no workarounds available. Regularly check your embedded device configurations to ensure they are up to date. You've got this! Update your system now, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| openwrt/openwrt | < 24.10.4 | 24.10.4 |