CVE-2020-28951 Use after free in n/a
A use-after-free vulnerability in OpenWrt's libuci allows attackers to potentially execute code or cause denial of service via malicious package names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28951?
CVE-2020-28951 is a critical use after free vulnerability in Openwrt Openwrt, published on 19 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c.
Weakness: CWE-416
Which versions are affected by CVE-2020-28951?
It affects 1 product.
Products include Openwrt Openwrt.
How do I fix CVE-2020-28951?
No fix has been published for CVE-2020-28951 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-28951 being exploited?
There is no known exploitation of CVE-2020-28951 in the wild and no public exploit code.
Other vulnerabilities in Openwrt Openwrt
- CVE-2026-62948 Cross-site scripting in openwrt
- CVE-2026-30871 OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
- CVE-2026-30872 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup
- CVE-2021-28961 Command injection in n/a
- CVE-2019-17367 Cross-site request forgery in n/a
Sources
Also known as GHSA-5w5g-2r2h-2cj2.