Description

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-26T11:16:38.343Z",
  "pubdate": "2026-08-26T11:16:38.343Z",
  "executiveSummary": "A critical buffer overflow vulnerability has been identified within the DHCPv6 implementation of EdgeMAX EdgeSwitch devices. This flaw permits a remote attacker positioned on an adjacent network to execute arbitrary code with elevated privileges, potentially leading to a complete compromise of the affected hardware.\nThe vulnerability originates from improper bounds checking during the processing of DHCPv6 packets. An attacker can leverage this weakness by crafting malformed DHCPv6 traffic to overflow the target's memory, thereby overwriting critical execution flow control structures.\nThe exploit requires no prior authentication, significantly lowering the barrier for entry. Once the buffer overflow is triggered, an attacker can achieve Remote Code Execution (RCE), granting them the ability to intercept traffic, modify network configurations, or utilize the device as a pivot point for further movement within the internal infrastructure.\nGiven that this vulnerability affects core network hardware, the risk to confidentiality, integrity, and availability is considered severe. Organizations utilizing EdgeMAX EdgeSwitch hardware are urged to treat this as a high-priority incident, as the proximity requirement of an adjacent network does not mitigate the risk posed by compromised or rogue devices already within the local broadcast domain.",
  "technicalDetails": "The vulnerability resides within the DHCPv6 packet parsing logic of the EdgeMAX EdgeSwitch firmware. When the device receives a DHCPv6 packet, the stack-based buffer intended to hold incoming DHCPv6 options and header data fails to adequately validate the length of the provided input against the actual buffer size allocated in memory.\nThe exploitation flow begins with the attacker constructing a malicious DHCPv6 packet containing payloads that exceed the defined maximum transmission unit (MTU) or the predefined length of the internal destination buffer. As the device processes this packet, the memory copy operation—likely using unsafe functions such as memcpy or strcpy—transfers the excess data past the end of the destination stack buffer. This corruption allows the attacker to overwrite adjacent memory addresses, including sensitive data structures like the Return Address or the Saved Frame Pointer on the stack.\nBy precisely calculating the memory offset, the attacker can redirect the program execution flow to an address of their choosing. This is typically achieved by placing a shellcode payload within the malformed packet or within other accessible memory segments and overwriting the function's return address to point to said shellcode. Due to the nature of the DHCPv6 service, which often runs with high-level system privileges or as a root-level process, the injected code executes with equivalent permissions.\nThe requirement for an 'adjacent network' implies the attacker must be connected to the same Layer 2 segment as the EdgeSwitch. In this environment, the attacker can bypass traditional perimeter firewalls to send the malformed packets directly to the device. Once RCE is achieved, the post-exploitation impact includes persistent control over the device, potential exfiltration of sensitive configuration data (such as administrative credentials, VLAN configurations, and routing tables), and the capability to perform man-in-the-middle attacks on all traffic traversing the switch ports. The lack of robust memory protection mechanisms, such as Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP), may further simplify the successful injection and execution of malicious payloads, allowing for reliable exploitation against affected EdgeSwitch firmware versions."
}