CVE-2026-62381

{"id": "CVE-2026-62381", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62381", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:50:25.578742Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "openwrt", "product": "luci", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "42d72f79cd8f057f241595abc761b39dab2d9f07"}], "packageName": "luci-lib-px5g", "collectionURL": "https://github.com/openwrt/luci", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T13:16:39.957", "references": [{"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/luci-lib-px5g-2040-bit-certificate-signing-heap-buffer-overflow", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched."}, {"lang": "es", "value": "luci-lib-px5g (LuCI) contiene un desbordamiento de b\u00fafer basado en mont\u00edculo en la rutina de codificaci\u00f3n ASN.1 nativa asn1_add_obj (x509write.c) al firmar un certificado con una clave RSA de 2040 bits. Para una firma de 255 bytes, la asignaci\u00f3n de BIT STRING se calcula a partir de la codificaci\u00f3n de longitud DER de 255 bytes, pero la carga \u00fatil escrita despu\u00e9s de anteponer el byte de bits no utilizados es de 256 bytes, lo que requiere un octeto de longitud DER adicional. Como resultado, la asignaci\u00f3n es de 259 bytes mientras que la etiqueta, la longitud, el byte de bits no utilizados y la firma requieren 260 bytes, y el memcpy final escribe un byte m\u00e1s all\u00e1 del b\u00fafer del mont\u00edculo. El desbordamiento es alcanzable a trav\u00e9s de la interfaz Lua exportada mediante create_selfsigned(); si es explotable remotamente depende de la aplicaci\u00f3n incrustada. El c\u00f3digo vulnerable est\u00e1 presente en las ramas de lanzamiento openwrt-18.06 hasta openwrt-25.12 y est\u00e1 ausente de master, donde el paquete luci-lib-px5g ha sido eliminado en lugar de parcheado."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}