CVE-2026-55490
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In OpenWrt before v25.12.5, an integer underflow in the handle_send_a() function of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The issue is fixed in v25.12.5.
Risk Assessment
An attacker can remotely crash the Emergency Access Daemon, potentially disrupting critical device services and enabling further attacks.
Recommendation
Immediately update OpenWrt to version v25.12.5 or later, which includes the fix for this vulnerability.
Original NVD description (English source)
OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.