CVE-2026-55490: OpenWrt Emergency Access Daemon DoS Flaw

CVE-2026-55490 Overview

CVE-2026-55490 is an integer underflow vulnerability in the Emergency Access Daemon (EAD) shipped with OpenWrt, a Linux operating system for embedded devices. The flaw resides in the handle_send_a() function and affects all OpenWrt releases before v25.12.5. An unauthenticated attacker on the local network can send a single crafted UDP packet that underflows a message length calculation, which is subsequently passed to memcpy as an oversized size argument. The result is a daemon crash and loss of emergency access functionality on the device.

Critical Impact
Any unauthenticated attacker with adjacent-network access can crash the Emergency Access Daemon with one UDP packet, denying an important recovery channel for OpenWrt devices.

Affected Products

OpenWrt versions prior to v25.12.5
Emergency Access Daemon (ead) component
Embedded devices running vulnerable OpenWrt builds with EAD enabled

Discovery Timeline

2026-07-07 - CVE-2026-55490 published to NVD
2026-07-08 - Last updated in NVD database
v25.12.5 - OpenWrt releases fixed version containing patch commit 63c0767f3d02f7b10b0f0b5293366bd059a08ca5

Technical Details for CVE-2026-55490

Vulnerability Analysis

The Emergency Access Daemon listens on the local network for UDP packets containing ead_msg structures. Inside handle_send_a(), the code reads a caller-supplied length field from the message header and subtracts the size of struct ead_msg_number before validating it. Because len is an unsigned type, subtracting from a value smaller than sizeof(struct ead_msg_number) wraps around to a very large positive number. The subsequent bounds check against MAXPARAMLEN + 1 passes only because the compiler compares the wrapped value against the wrong side of the intended range, and the oversized len is then handed to memcpy. The daemon reads far past the packet buffer and crashes, producing a denial-of-service condition [CWE-191].

Root Cause

The root cause is an unsigned integer underflow. The original code computed len = ntohl(msg->len) - sizeof(struct ead_msg_number) without first verifying that ntohl(msg->len) was at least sizeof(struct ead_msg_number). Any attacker-supplied msg->len below that threshold produced a wrapped length that bypassed the size sanity check.

Attack Vector

Exploitation requires network adjacency to the target device — the attacker must be able to reach the EAD UDP listener on the local segment. No authentication or user interaction is required. A single crafted packet is sufficient to trigger the crash, and the attack can be repeated to keep the daemon offline.

// Patch from OpenWrt commit 63c0767f3d02f7b10b0f0b5293366bd059a08ca5
// package/network/services/ead/src/ead.c - handle_send_a()
{
	struct ead_msg *msg = &pkt->msg;
	struct ead_msg_number *number = EAD_DATA(msg, number);
-	len = ntohl(msg->len) - sizeof(struct ead_msg_number);
+	uint32_t msg_len = ntohl(msg->len);

-	if (len > MAXPARAMLEN + 1)
+	if (msg_len < sizeof(struct ead_msg_number) ||
+	    msg_len - sizeof(struct ead_msg_number) > MAXPARAMLEN + 1)
		return false;

+	len = msg_len - sizeof(struct ead_msg_number);
+
	A.len = len;
	A.data = abuf;
	memcpy(A.data, number->data, len);
}
// Source: https://github.com/openwrt/openwrt/commit/63c0767f3d02f7b10b0f0b5293366bd059a08ca5

The patch adds an explicit lower-bound check on msg_len before performing the subtraction, preventing the underflow from ever reaching memcpy.

Detection Methods for CVE-2026-55490

Indicators of Compromise

Unexpected termination or repeated restart of the ead process on OpenWrt devices
Inbound UDP traffic to the EAD listener port from unexpected local hosts
Kernel or system log entries showing segmentation faults tied to the ead binary
Loss of emergency access availability on devices that otherwise remain reachable

Detection Strategies

Monitor process supervision logs (procd, logread) for ead crash and respawn events on OpenWrt devices
Capture UDP traffic destined for the EAD service and inspect ead_msg length fields that fall below sizeof(struct ead_msg_number)
Correlate device management-plane anomalies with adjacent-network host activity to identify the source of malformed packets

Monitoring Recommendations

Track OpenWrt firmware versions across the fleet and flag any device running a build older than v25.12.5
Alert on repeated ead service restarts within short time windows, which indicate active exploitation attempts
Baseline normal EAD traffic patterns so unauthenticated packets from unknown local hosts stand out

How to Mitigate CVE-2026-55490

Immediate Actions Required

Upgrade OpenWrt to v25.12.5 or later on all affected embedded devices
Restrict layer-2 access to management VLANs so untrusted hosts cannot reach the EAD listener
If EAD is not required, disable the daemon on production devices to remove the attack surface entirely

Patch Information

The issue is fixed in OpenWrt v25.12.5. The corrective change is commit 63c0767f3d02f7b10b0f0b5293366bd059a08ca5, which validates msg_len before subtraction. Full details are available in the OpenWrt Security Advisory GHSA-9558-77jp-g3fw and the OpenWrt v25.12.5 Release Notes.

Workarounds

Block or firewall the EAD UDP port at the device boundary so only trusted management hosts can send packets
Segment embedded devices onto a dedicated management network isolated from user and guest traffic
Stop and disable the ead service where emergency access is not operationally required

bash

# Disable and stop the Emergency Access Daemon on OpenWrt
/etc/init.d/ead stop
/etc/init.d/ead disable

# Verify installed OpenWrt version meets the patched release
cat /etc/openwrt_release | grep DISTRIB_RELEASE
# Expected: DISTRIB_RELEASE='25.12.5' or later