CVE-2025-62526: OpenWrt Ubusd Buffer Overflow Vulnerability

CVE-2025-62526 Overview

CVE-2025-62526 is a heap buffer overflow in the ubusd daemon shipped with OpenWrt, a Linux operating system for embedded devices. The flaw resides in the event registration parsing code inside ubusd_event.c. Because the vulnerable code executes before Access Control List (ACL) checks, any local ubus client can send a crafted subscription message. Successful exploitation corrupts the heap and can allow arbitrary code execution in the context of the ubus daemon. The crafted subscription also bypasses the listen ACL. The issue affects all OpenWrt releases prior to 24.10.4 and is tracked under [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
Local attackers with ubus client access can corrupt the heap and execute arbitrary code as the ubusd daemon, bypassing listen ACL restrictions on affected OpenWrt routers and embedded devices.

Affected Products

OpenWrt versions prior to 24.10.4
OpenWrt ubus daemon (ubusd) component
Embedded devices and routers running vulnerable OpenWrt builds

Discovery Timeline

2025-10-22 - CVE-2025-62526 published to NVD
2025-10-22 - OpenWrt publishes advisory 2025-10-22-1 and releases fixed ubus build
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62526

Vulnerability Analysis

The ubus daemon provides inter-process communication between OpenWrt system services. Clients register interest in events by sending subscription messages containing a pattern string. The event registration handler in ubusd_event.c parses this pattern and allocates a heap buffer sized to hold it, but the length accounting is incorrect. An attacker can craft a subscription that causes the parser to write past the end of the allocated chunk, modifying adjacent heap metadata including the head structure.

Because ubusd runs as a privileged system service, corruption of its heap enables arbitrary code execution in a privileged context. The daemon is a central IPC broker in OpenWrt, so a compromised ubusd can influence configuration, networking, and firewall components.

Root Cause

Two defects combine to create the vulnerability. First, the pattern parsing logic in the event registration path miscalculates buffer boundaries, producing a heap-based buffer overflow ([CWE-122]). Second, the ubusd_acl_check() call for UBUS_ACL_LISTEN was gated on pattern[0] being non-empty, allowing empty or specifically crafted patterns to skip the ACL enforcement entirely. The parsing routine also executes before any ACL evaluation, so unprivileged clients reach the vulnerable code.

Attack Vector

Exploitation requires local access to the ubus socket, which is available to any process able to open the daemon's Unix domain socket. A malicious local user or a compromised low-privilege service sends a crafted event subscription message. The attacker can achieve two outcomes: bypass the listen ACL to observe events they are not authorized to see, and corrupt the heap to hijack control flow inside ubusd.

// Patch: ubusd_event.c - remove the pattern[0] gate on ACL check
// Source: https://github.com/openwrt/ubus/commit/60e04048a0e2f3e33651c19e62861b41be4c290f

		len--;
	}

-	if (pattern[0] && ubusd_acl_check(cl, pattern, NULL, UBUS_ACL_LISTEN))
+	if (ubusd_acl_check(cl, pattern, NULL, UBUS_ACL_LISTEN))
 		return UBUS_STATUS_PERMISSION_DENIED;

	ev = calloc(1, sizeof(*ev) + len + 1);

Detection Methods for CVE-2025-62526

Indicators of Compromise

Unexpected crashes or restarts of the ubusd process recorded in logread or dmesg output.
Unauthorized processes subscribing to ubus events outside their normal ACL scope.
Presence of OpenWrt firmware images built from ubus source dated earlier than 2025-10-17 (version ad2768bbc166b4dcb32665d7b3434d54150b2abc or older).

Detection Strategies

Inventory OpenWrt devices and compare running firmware against version 24.10.4 or later using opkg list-installed ubus or the /etc/openwrt_release file.
Monitor ubusd for abnormal memory usage patterns and segmentation faults through system logging.
Audit installed packages for the patched ubus commit 60e04048a0e2f3e33651c19e62861b41be4c290f referenced in the vendor advisory.

Monitoring Recommendations

Forward ubusd service logs and kernel crash reports from OpenWrt devices to a centralized logging pipeline.
Alert on process crashes and unexpected restarts of system-critical daemons on embedded fleets.
Track outbound configuration changes originating from routers to identify post-exploitation behavior.

How to Mitigate CVE-2025-62526

Immediate Actions Required

Upgrade all OpenWrt devices to version 24.10.4 or later, which ships the fixed ubus package.
Restrict local shell and service account access on OpenWrt devices to trusted administrators only.
Review installed third-party packages that interact with ubus to confirm they originate from trusted sources.

Patch Information

OpenWrt fixed the flaw in release 24.10.4. The upstream ubus fixes are contained in commits 60e04048, aa4a7ee1, and d31effb4. The OpenWrt package bump is tracked in commits 4b907e69 and a7901969. See the GitHub Security Advisory GHSA-cp32-65v4-cp73 and OpenWrt Advisory 2025-10-22-1 for authoritative details.

Workarounds

No workarounds are available according to the OpenWrt security advisory; patching to 24.10.4 is the only remediation.
As a compensating control, limit which local users and services can access the ubus Unix socket path.

bash

# Verify the installed ubus/OpenWrt version and update
cat /etc/openwrt_release
opkg update
opkg list-upgradable | grep -E 'ubus|ubusd'
opkg upgrade ubus ubusd libubus20250102