Executive brief
Hamlib is a library used to control ham radios, rotators, and amplifiers via a network daemon called rigctld. An unauthenticated attacker on the network can send specially crafted commands to the default-enabled rigctld service to crash the daemon or leak sensitive memory contents, disrupting radio control operations and potentially exposing system information.
Technical details
The vulnerability involves two distinct flaws in the unauthenticated rigctld send_raw command handler. First, rigctl_send_raw() in tests/rigctl_parse.c writes a NUL byte outside a 200-byte stack buffer (at buf[buf_len + 1]), causing a stack buffer overflow that can crash the daemon or corrupt adjacent stack memory. Second, rig_send_raw() in src/rig.c incorrectly copies reply_len - 1 bytes instead of the actual number of bytes received, allowing an attacker to read up to 198 bytes of uninitialized stack data. An unauthenticated remote client can trigger both flaws by sending a CR-terminated short payload to TCP port 4532 under the default no-password configuration. The issue is fixed in Hamlib 4.7.2.
Affected products
- Hamlib Hamlib prior to 4.7.2
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 4.7.2