Is CVE-2025-62526 actively exploited?

CVE-2025-62526 has no public evidence of in-the-wild exploitation as of 2025-10-30.

What is the CVSS score for CVE-2025-62526?

CVE-2025-62526 has a CVSS score of 7.9 (HIGH severity). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H.

How do I patch CVE-2025-62526?

Patch guidance is available from openwrt security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-62526.

Fix CVE-2025-62526 - HIGH openwrt openwrt

Description

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such messages. In addition to the heap corruption, the crafted subscription also results in a bypass of the listen ACL. This is fixed in OpenWrt 24.10.4. There are no workarounds.

CVSS Metrics

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Attack Vector: local
Complexity: low
Privileges: low
User Action: none
Scope: changed
Confidentiality: low
Integrity: low
Availability: high
Weaknesses: CWE-122

Metadata

Primary Vendor: OPENWRT
Published: 10/22/2025
Last Modified: 10/30/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

openwrt : openwrt

Remediation Guidance

Executive Summary

Cite this page

CVE-2025-62526. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2025-62526

View on NIST NVD

CVE-2025-62526 vulnerability