Description

Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T06:16:54.647Z",
  "pubdate": "2026-09-14T06:16:54.647Z",
  "executiveSummary": "The Bonjour Gateway component within Extreme Networks IQ Engine is susceptible to a buffer overflow vulnerability. This flaw resides in the ah_bgd daemon, specifically triggered via the ah_event_send function.\nThe vulnerability allows for memory corruption within the ah_bgd process, which can lead to arbitrary code execution or a denial-of-service state for the gateway service.\nAffected software versions include Extreme Networks IQ Engine releases prior to 10.6r1a, and versions in the 10.6r4 branch prior to 10.6r5.\nAn unauthenticated, remote attacker may potentially leverage this vulnerability by sending crafted input that exceeds the allocated buffer size in the targeted function.\nThe risk implication is significant as it affects critical networking infrastructure, potentially allowing an attacker to compromise the integrity of the gateway and gain unauthorized control over affected devices, or disrupt Bonjour service discovery for local network clients.",
  "technicalDetails": "The vulnerability is identified as a classic buffer overflow residing within the ah_bgd (Bonjour Gateway Daemon) component of the Extreme Networks IQ Engine. The root cause of the flaw is an improper bounds check or lack of input validation within the ah_event_send function, which is responsible for processing event data.\nIn the context of the Bonjour Gateway, ah_bgd manages mDNS (Multicast DNS) traffic across network boundaries. The ah_event_send function is utilized to marshal or process incoming events before transmission or internal routing. When an attacker sends a specially crafted packet that exceeds the static buffer size allocated by the ah_event_send function, the data overflows the buffer and overwrites adjacent memory locations on the stack or heap.\nThe exploitation flow begins with the attacker crafting a malicious mDNS-related payload designed to trigger the overflow when processed by the ah_bgd service. Since the daemon is typically listening for network-based service discovery requests, it is directly exposed to remote input. Once the input is received, the ah_event_send function attempts to store the oversized data into a fixed-length memory structure without verifying the input length. This causes the application to overwrite critical instruction pointers, such as the saved return address or function pointers within the process's address space.\nUpon successful exploitation, an attacker can redirect the execution flow to arbitrary shellcode embedded within the payload or leverage Return-Oriented Programming (ROP) chains to bypass security mitigations like ASLR or DEP, assuming they are implemented in the environment. If the process is not successfully hijacked for code execution, the memory corruption will almost certainly result in a segmentation fault, leading to the crash of the ah_bgd process and subsequent denial of service for Bonjour-based discovery services.\nThe affected versions include any IQ Engine software released prior to 10.6r1a, as well as the specific 10.6r4 release train prior to 10.6r5, where the fix was integrated. The vulnerability is highly critical because the ah_bgd process typically runs with elevated privileges to interface with network sockets, meaning an attacker gaining code execution would likely achieve root-level privileges on the device, allowing for persistent installation or network-wide traffic interception."
}