Netopeer2 CVE-2026-63201

Requires: (1) valid low-privileged NETCONF account credentials (the CVSS PR:L confirms authentication is needed - this is NOT unauthenticated), (2) network reachability to the NETCONF server, typically the NETCONF-over-SSH subsystem on port 830, and (3) the ability to submit a 'get' RPC whose subtree filter is invalid and whose text contains format specifiers (e.g. %s%s%s%s). No non-default configuration is required - the vulnerable ERR()/np2log_printf() logging path is reached by the standard invalid-filter handling in np2srv_rpc_get_cb(). The primary limiting factor is the authentication requirement; an attacker without NETCONF credentials cannot reach the vulnerable code path. Confirmed on version 2.8.7 (with libyang 5.8.6, sysrepo 5.1.0, libnetconf2 4.4.10) on Ubuntu 24.04 even with _FORTIFY_SOURCE=2.

This is a genuine but bounded availability risk, not a critical remote-code-execution emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the confirmed behavior agree: a network-reachable, low-privileged but authenticated NETCONF user can reliably crash netopeer2-server, and the only impact metric set is VA:H (availability high); VC/VI are N, matching the advisory's statement that denial of service is the confirmed impact and that reliable remote code execution was NOT confirmed. The 'RCE' tag therefore overstates the confirmed impact - CWE-134 format-string bugs can in principle escalate, but the reporter explicitly could not confirm RCE, so treat impact as DoS unless proven otherwise. No EPSS score and no CISA KEV entry are present in the input, so there is no signal of active or widespread exploitation; however, a detailed, reproduced proof-of-concept is published in the GHSA advisory, so exploitation is trivially achievable by anyone with valid low-privilege NETCONF credentials. The vendor/vuln.today decision label is 'this_week' (not act_now/emergency), consistent with authenticated DoS against a specialized server. Net: real priority for operators who expose netopeer2 to semi-trusted users, but the authentication requirement (PR:L) meaningfully limits the exposed population versus an unauthenticated flaw.

An attacker who already holds low-privileged NETCONF credentials opens a NETCONF-over-SSH session (default port 830) and sends a single 'get' RPC whose subtree filter text is a string of format specifiers such as %s%s%s%s. Because the invalid-filter error message is later reused as a format string in np2log(), vsyslog() dereferences attacker-controlled percent sequences and the server process crashes. A complete working proof-of-concept payload and reproduction command are published in the GHSA advisory and were confirmed on 2.8.7 under AddressSanitizer.