Vulnerabilities > CVE-2020-28951 - Use After Free vulnerability in Openwrt

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

openwrt

CWE-416

critical

NVD

Published: 2020-11-19

Updated: 2024-11-21

Summary

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c.

Vulnerable Configurations

Part	Description	Count
OS	Openwrt Openwrt Openwrt 19.07.0 Openwrt Openwrt 19.07.1 Openwrt Openwrt 19.07.2 Openwrt Openwrt 19.07.3 Openwrt Openwrt 19.07.4 Openwrt Openwrt - Openwrt Openwrt 15.05.1 Openwrt Openwrt 17.01.0 Openwrt Openwrt 17.01.1 Openwrt Openwrt 17.01.2 Openwrt Openwrt 17.01.3 Openwrt Openwrt 17.01.4 Openwrt Openwrt 17.01.5 Openwrt Openwrt 17.01.6 Openwrt Openwrt 17.01.7 Openwrt Openwrt 18.06.0 Openwrt Openwrt 18.06.1 Openwrt Openwrt 18.06.2 Openwrt Openwrt 18.06.3 Openwrt Openwrt 18.06.4 Openwrt Openwrt 18.06.5 Openwrt Openwrt 18.06.6 Openwrt Openwrt 18.06.7 Openwrt Openwrt 18.06.8	32

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References