Executive brief
OpenWrt is a Linux-based operating system used in embedded devices like routers. A vulnerability in its Emergency Access Daemon (EAD) allows an attacker on the same local network to crash the service by sending a single specially crafted network packet. This disables the emergency recovery feature, potentially preventing administrators from regaining access to the device during a failure.
Technical details
An integer underflow exists in the handle_send_a() function within ead.c of the Emergency Access Daemon. The vulnerability occurs when calculating the length of the SRP 'A' parameter: the code subtracts the size of a header from the message length provided in the packet. If the provided length is zero, the unsigned subtraction wraps to a large value, which is then treated as -1 when assigned to a signed integer. This bypasses a signed bounds check and is subsequently passed to memcpy() as a very large size_t value, leading to an out-of-bounds read and daemon crash. The attack is reachable via UDP port 56026 by an unauthenticated attacker on the local network segment. The issue is fixed in OpenWrt v25.12.5.
Affected products
- OpenWrt OpenWrt < 25.12.5
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-01: patched: OpenWrt v25.12.5 released
- 2026-07-07: disclosed: CVE-2026-55490 published to NVD