CVE-2026-42799: ASR Kestrel Buffer Overflow Vulnerability

CVE-2026-42799 Overview

An out-of-bounds read vulnerability has been identified in ASR Kestrel firmware within the nr_fw modules. This vulnerability is specifically associated with the NrPwrCtrl.C file located at Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. The flaw allows attackers to trigger buffer overflow conditions by exploiting improper boundary checks during memory read operations.

Critical Impact
Network-accessible attackers with low privileges can exploit this vulnerability to potentially cause information disclosure, data integrity issues, and service disruption across affected systems.

Affected Products

ASR Kestrel firmware versions before 2026/02/10
ASR nr_fw modules (NrPwrCtrl component)

Discovery Timeline

2026-04-30 - CVE CVE-2026-42799 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-42799

Vulnerability Analysis

This out-of-bounds read vulnerability (CWE-125) occurs within the power control module of the ASR Kestrel firmware. The vulnerability allows an attacker to read memory beyond the intended buffer boundaries, which can lead to information disclosure or trigger secondary buffer overflow conditions.

The flaw is exploitable over the network with low attack complexity. While the attacker requires low-level privileges to initiate the attack, no user interaction is needed. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself, affecting confidentiality, integrity, and availability of the broader system.

Root Cause

The root cause of this vulnerability lies in insufficient boundary validation within the NrPwrCtrl.C file in the nr_fw modules. When processing input data, the code fails to properly verify that read operations stay within the allocated buffer boundaries. This allows memory access beyond the intended buffer limits, enabling attackers to read adjacent memory regions or trigger buffer overflow conditions.

Attack Vector

The attack is network-based and can be executed remotely. An attacker with low-level privileges can craft malicious requests targeting the vulnerable power control functionality in the nr_fw modules. The exploitation does not require any user interaction, making it particularly dangerous in networked environments.

The vulnerability manifests in the boundary handling routines within NrPwrCtrl.C. When processing power control operations, insufficient validation of input parameters allows read operations to exceed buffer boundaries. See the ASR Micro PSIRT Information for detailed technical guidance.

Detection Methods for CVE-2026-42799

Indicators of Compromise

Unexpected memory access patterns or crashes in the nr_fw module components
Anomalous network traffic targeting power control interfaces
System instability or unexpected behavior in ASR Kestrel devices
Error logs indicating boundary violations or memory access exceptions

Detection Strategies

Monitor firmware components for signs of exploitation attempts targeting the NrPwrCtrl functionality
Implement network intrusion detection rules for anomalous traffic patterns to ASR Kestrel devices
Review system logs for memory access violations or unexpected power control operations
Deploy endpoint monitoring for firmware-level anomalies on affected devices

Monitoring Recommendations

Enable verbose logging on ASR Kestrel devices to capture potential exploitation attempts
Implement network segmentation to isolate vulnerable firmware devices from untrusted networks
Monitor for unusual patterns in power control operations that may indicate exploitation
Set up alerts for any firmware crashes or restarts that could indicate active exploitation attempts

How to Mitigate CVE-2026-42799

Immediate Actions Required

Update ASR Kestrel firmware to versions released on or after 2026/02/10
Restrict network access to affected devices until patching is complete
Implement network segmentation to limit exposure of vulnerable components
Monitor systems for signs of exploitation using the detection strategies outlined above

Patch Information

ASR Micro has addressed this vulnerability in Kestrel firmware versions released from 2026/02/10 onwards. Organizations should consult the ASR Micro PSIRT Information for official patch downloads and detailed remediation guidance. Ensure firmware updates are applied following your organization's change management procedures.

Workarounds

Restrict network access to ASR Kestrel devices using firewall rules or access control lists
Implement network segmentation to isolate affected devices from untrusted networks
Limit the privileges of accounts that can interact with the vulnerable power control functionality
Monitor and audit all access to affected systems until patches can be applied

bash

# Example: Restrict network access to ASR Kestrel devices
# Add firewall rules to limit access to trusted management networks only
iptables -A INPUT -p tcp -d <KESTREL_DEVICE_IP> -s <TRUSTED_MGMT_NETWORK> -j ACCEPT
iptables -A INPUT -p tcp -d <KESTREL_DEVICE_IP> -j DROP