What is the CVSS score of CVE-2026-55490?

CVE-2026-55490 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-55490?

Yes, a patch is available for CVE-2026-55490. Update the affected software to the latest version immediately.

OpenWrt CVE-2026-55490

EUVD-2026-42110 MEDIUM

Integer Underflow (CWE-191)

2026-07-07 GitHub_M

Denial Of Service Integer Overflow Openwrt

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AV:A because exploitation requires local network adjacency; PR:N and AC:L since a single unauthenticated UDP packet suffices; A:H for daemon crash; C:N/I:N as no data is accessed or modified.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 23:01 EUVD

Analysis Generated

Jul 07, 2026 - 22:09 vuln.today

CVE Published

Jul 07, 2026 - 21:08 cve.org

MEDIUM 6.5

DescriptionCVE.org

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.

AnalysisAI

Integer underflow in the OpenWrt Emergency Access Daemon crashes the daemon when any unauthenticated attacker on the local network sends a single crafted UDP packet to it. Affected are all OpenWrt versions prior to v25.12.5. The CVSS adjacent-network vector (AV:A) constrains the attack surface to local or adjacent network segments, but within that context exploitation requires no credentials and no user interaction - a single malformed packet suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; the patch is confirmed available in v25.12.5.

Technical ContextAI

OpenWrt is an open-source Linux distribution targeting embedded networking devices such as home routers, access points, and IoT gateways (CPE: cpe:2.3:a:openwrt:openwrt:*:*:*:*:*:*:*:*). The vulnerability resides in the handle_send_a() function of the Emergency Access Daemon (EAD), a service that listens on UDP. The root cause is CWE-191 (Integer Underflow): the daemon subtracts a value from the message length field before performing a bounds check, allowing a specially crafted packet to cause the length to wrap below zero and become a very large unsigned integer. This inflated value is subsequently passed directly to memcpy as the size argument, resulting in an out-of-bounds memory operation that crashes the daemon process. The attack is self-contained within a single UDP packet, making it trivially deliverable.

RemediationAI

Upgrade to OpenWrt v25.12.5, which contains the confirmed fix per the upstream release at https://github.com/openwrt/openwrt/releases/tag/v25.12.5 and the patch commit at https://github.com/openwrt/openwrt/commit/63c0767f3d02f7b10b0f0b5293366bd059a08ca5. If an immediate upgrade is not feasible, a viable compensating control is to restrict UDP traffic destined for the Emergency Access Daemon's port to trusted administrative hosts only via firewall rules or OpenWrt's built-in nftables/iptables configuration - this directly mitigates the adjacent-network attack vector by limiting which hosts can deliver the crafted packet. Alternatively, disabling the Emergency Access Daemon entirely (if not required for device management) eliminates the attack surface entirely, though this may impair out-of-band recovery capabilities. Note that network-level filtering depends on correct firewall rule ordering and does not fix the underlying integer underflow; patching to v25.12.5 remains the definitive resolution.