CVE-2026-55490: OpenWrt Emergency Access Daemon Integer Underflow DoS

Technical summary

CVE-2026-55490 is an integer underflow vulnerability in handle_send_a() within OpenWrt's Emergency Access Daemon. The vulnerability occurs when processing incoming UDP packets: a message length value is decremented without proper range validation, causing it to underflow to a very large unsigned integer. This oversized length is subsequently passed as a size parameter to memcpy(), triggering a buffer over-read or crash. The flaw requires only network adjacency and no authentication, making it trivially exploitable on local networks. The root cause is insufficient bounds checking before the arithmetic operation (CWE-191).

Business impact

Denial of service against the Emergency Access Daemon can disrupt remote management and recovery capabilities on affected OpenWrt devices. In operational environments relying on these devices for network management, uptime, or failover, an attacker on the local network could temporarily disable critical daemon functionality. While confidentiality and integrity are not compromised, availability impact is direct and immediate. This is particularly concerning in shared network environments or where physical security of the local network is not absolute.

Affected systems

OpenWrt versions prior to v25.12.5 are affected. The vulnerability is specific to the Emergency Access Daemon component. Any deployment running an earlier release on routers, access points, or embedded Linux devices is exposed if those devices are reachable by untrusted local network participants.

Exploitability

Exploitability is straightforward: the attack requires only the ability to send a single UDP packet to the daemon from the local network segment. No authentication is required, no user interaction is needed, and no complex configuration is necessary. Any system on the local network can trigger the crash, making this a low-friction attack vector. However, the attacker must have network access to the device—remote exploitation from the internet is not possible.

Remediation

Upgrade OpenWrt to v25.12.5 or later. This release includes fixes to the integer underflow and proper bounds validation in handle_send_a(). For organizations unable to upgrade immediately, implement network segmentation to restrict which systems can reach the Emergency Access Daemon, and monitor for unusual UDP traffic targeting the daemon port.

Patch guidance

Apply the official OpenWrt security update to v25.12.5 or newer through your standard firmware update process. Verify the integrity of the update file using the checksums or signatures provided by the OpenWrt project. Plan the update during a maintenance window to account for device reboot time. After patching, verify daemon functionality by testing remote access features if applicable to your environment.

Detection guidance

Monitor for crashes or restarts of the Emergency Access Daemon on production devices. Implement network-based detection for unusual UDP traffic patterns targeting the daemon—specifically, look for packets with invalid or anomalously small message length fields from local network sources. Examine system logs for repeated daemon crashes or emergency restarts that coincide with network events. Alert on any unauthorized attempts to interact with the daemon from unexpected local network addresses.

Why prioritize this

Although the CVSS score of 6.5 (Medium) reflects the attack complexity and network proximity requirement, this vulnerability should be treated with moderate-to-high priority because: (1) exploitation is trivial and requires only a single packet, (2) the attack can be launched by any local network participant without credentials, and (3) it directly impacts availability of management infrastructure. Environments with untrusted or semi-trusted local networks should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: Attack Vector (Adjacent) – the attacker must be on the local network; Attack Complexity (Low) – no complex steps required; Privileges Required (None) – no authentication; User Interaction (None) – automatic crash; Scope (Unchanged) – only the daemon is affected; Confidentiality (None) – no data disclosure; Integrity (None) – no data modification; Availability (High) – complete denial of service to the daemon. The Medium severity balances the ease of exploitation and immediate availability impact against the requirement for local network access.

Frequently asked questions