BusyBox CVE-2026-29004

Attacker must be network-adjacent (same Layer 2 broadcast domain or VLAN) to the target BusyBox device running udhcpc6. The DHCPv6 client must be actively enabled and configured to request or renew IPv6 addresses - many embedded systems disable IPv6 by default, limiting exposure. The attack requires the victim device to process DHCPv6 responses during initial network setup, DHCP renewal cycles, or manual DHCPv6 client restart. Exploitation success depends on the embedded system lacking heap exploit mitigations (ASLR, stack canaries, heap integrity checks), which is typical for resource-constrained BusyBox deployments but not universal. No user interaction or authentication is required once the attacker has adjacent network access. Limiting factors: AV:A scope restricts remote internet exploitation; requires local network presence via physical access, compromised network device, or insider threat. Systems with IPv6 disabled or using static addressing are not vulnerable.

Real-world risk is ELEVATED despite moderate CVSS 7.2 score. The Adjacent Network attack vector (AV:A) requires attacker presence on the same network segment as the DHCPv6 client, which limits internet-wide exploitation but is realistic in enterprise networks, public Wi-Fi, compromised IoT networks, or supply chain attacks targeting embedded devices. Attack complexity is LOW with no authentication or user interaction required. The heap overflow primitive enables both high integrity and availability impacts (VI:H/VA:H) - denial of service is trivial, and code execution is feasible on systems without heap hardening, which describes most embedded BusyBox deployments. VulnCheck's public disclosure and proof-of-concept availability significantly lower the exploitation barrier. Not currently in CISA KEV, suggesting targeted rather than mass exploitation to date, but BusyBox's ubiquity in IoT/embedded contexts (routers, NAS devices, DVRs, industrial controls) presents massive attack surface. SSVC decision: Exploitation status is POC public, automatable via network scanning for DHCPv6-enabled BusyBox devices, technical impact is total system compromise on vulnerable embedded targets. Priority should be IMMEDIATE for internet-facing or enterprise-networked embedded devices, MEDIUM for isolated IoT deployments.

An attacker positions themselves on the same network segment as BusyBox-powered IoT devices (e.g., corporate network with smart building controls, or compromised home router network). The attacker deploys a rogue DHCPv6 server using standard tools like dibbler-server or custom scripts. When the BusyBox udhcpc6 client sends DHCPv6 SOLICIT or REQUEST messages during network initialization or periodic renewal, the attacker's server responds with a crafted DHCPv6 ADVERTISE or REPLY packet containing a malformed D6_OPT_DNS_SERVERS option with manipulated address count. This triggers the undersized heap allocation in option_to_env(), causing a controlled heap overflow that corrupts adjacent heap metadata or function pointers, leading to code execution with the privileges of the DHCPv6 client process (typically root on embedded systems).