Security Evidence Pack

dnsmasq-dhcpv6 2.73-1

DNS cache poisoning vulnerability due to missing DNSSEC validation allows attackers to redirect firmware update checks and critical service lookups to malicious servers, enabling supply chain compromise.

miniupnpd 2.1-1

Unauthenticated UPnP port forwarding allows remote attackers to open arbitrary firewall ports and expose internal services (SSH, HTTP admin panel) to the internet without credentials via crafted SSDP packets.

netifd 2018-11-19

UCI configuration parser lacks input sanitization, enabling authenticated attackers to inject shell commands through malicious network interface definitions, achieving root code execution.

uhttpd 2018-11-28 / LuCI

Session cookies lack HttpOnly and Secure flags, enabling session hijacking through XSS attacks in LuCI modules; attackers can steal administrator sessions via injected JavaScript.

rpcd 2018-11-28

RPC daemon lacks granular per-method authorization, allowing any authenticated user to invoke privileged system configuration APIs intended for administrators.

uclient-fetch / opkg

Package manager performs HTTP-based updates without enforcing cryptographic signature verification beyond the initial keyring check, enabling MITM attackers to inject malicious firmware packages during updates.

Dropbear 2017.75-7.1

Outdated SSH implementation predates critical authentication-bypass and cryptographic-weakness patches from 2019+, exposing administrative access to brute-force and protocol-downgrade attacks.

firewall 2018-08-13 / iptables 1.6.2

Firewall package predates netfilter connection-tracking vulnerabilities (CVE-2019-11479 class), enabling attackers to bypass firewall rules via TCP SACK manipulation and fragment-reassembly attacks.

linux-kernel 4.14.95

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS via heap memory corruption through user name space.

linux-kernel 4.14.95

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation via a double-free when NF_DROP is issued with a drop error resembling NF_ACCEPT.

linux-kernel 4.14.95

ptrace_link in kernel/ptrace.c mishandles the recording of credentials of a process creating a ptrace relationship, allowing local users to obtain root access via certain parent/child process scenarios.

linux-kernel 4.14.95

A vulnerability in the Linux kernel's cgroup_release_agent_write (kernel/cgroup/cgroup-v1.c) allows the cgroups v1 release_agent feature to escalate privileges and bypass namespace isolation under certain circumstances.

busybox 1.28.4

BusyBox wget prior to a 2018 fix contains a buffer overflow vulnerability resulting in heap buffer overflow, exploitable via network connectivity.

busybox 1.28.4

A stack overflow vulnerability in ash.c (busybox before 1.35) can be executed from command to arbitrary code execution in IoT/connected-vehicle deployment contexts.