dhcpoptinj

DHCP 옵션 인젝터 DHCP 요청을 가로채서 발신자가 모르게 몇 가지 추가 DHCP 옵션을 끼워 넣고 싶었던 적이 있나요? 아마 없을 겁니다. 하지만 그런 필요가 생긴다면, dhcpoptinj 가 바라건대 도움이 될 것입니다. 왜 DHCP 요청을 변조하는 데는 여러 이유가 있을 수 있지만, 아마도 문제를 해결하기 위해 훨씬 더 나은 방법을 찾아야 할 가능성이 높습니다. DHCP 서버/클라이언트에 접근할 수 없어서 DHCP 옵션을 수정해야 하거나, DHCP 소프트웨어 설정이 어렵거나원하는 작업을 지원하지 않는 경우, 매우...

CVE-2026-11834

CVE-2026-11834 PoC TP-Link DHCP Option 66 の未認証RCE（CVE-2026-11834） 概要 DHCP Option 66（「TFTPサーバー名」）の処理におけるTP-Linkルーターファームウェアのコマンドインジェクションの脆弱性（CWE-78）により、同一ネットワークセグメント上の未認証の攻撃者がrootとして任意のコマンドを実行できます。デバイスがWANインターフェースでDHCPクライアントとして動作するとき、リースで返されたOption...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – DHCPオプションインジェクションによるVPNスプリットトンネリングバイパス プログラムコード（PythonによるDHCPサーバー＋クライアントのシミュレーション） root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def senddhcpofferclientmac, offerip: Craft a DHCP OFFER...

freebsd-dhclient-poc

CVE-2020-7461 재현 PoC 저자: Moshe Kol, Shlomi Oberman FreeBSD dhclient의 DHCP 옵션 119 파싱 시 힙 기반 버퍼 오버플로우 취약점CVE-2020-7461에 대한 재현 PoC입니다. 문제는 sbin/dhclient/options.c 파일의 findsearchdomainnamelen 함수에 있습니다. 이 함수는 서버로부터 DHCP 옵션 119도메인 검색, RFC 3397가 제공될 때 expanddomainsearch에 의해 호출됩니다. 압축 방식이 사용될 때,...

Security update for wicked (important)

openSUSE security update: security update for wicked ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21669-1 Rating: important References: bsc1274627 Cross-References: CVE-2026-71401 CVE-2026-71402 CVSS scores: CVE-2026-71401 SUSE : 7.5...

OPENSUSE-SU-2026:21669-1 Security update for wicked

This update for wicked fixes the following issues: Changes in wicked: - Fix two OOB reads in nicaptureinspectudpheader and improve: - Reject packets with iplen ihl to avoid a sizet underflow of the UDP length, which the checksum truncates to uint16t bsc1274627, CVE-2026-71401. - Set payloadlen to...

SUSE-SU-2026:2720-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 055+suse.365.g79144c5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

Exploit for CVE-2026-11834

CVE-2026-11834 PoC TP-Link DHCP Option 66 Unauthenticated RC...

CVE-2026-11834

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...

EUVD-2026-38339

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...

CVE-2026-11834 Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...

CVE-2026-11834: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...

CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption src/if-options.c:1886, the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state caus...

CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption src/if-options.c:1886, the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state caus...

CVE-2025-70102

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parseoption src/if-options.c:1886, the code performs a member access on a NULL pointer of type 'struct dhcpopt' when an unexpected/invalid option token or parsing state caus...

CVE-2026-45160 ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1, an out-of-bounds read flaw exists in the DHCP server option parser parseoptions in components/lwip/apps/dhcpserver/dhcpserver.c shipped with ESP-IDF's lwIP component. The pars...

ESP-IDF 缓冲区错误漏洞

ESP-IDF is an open-source development framework for Espressif’s SoCs, supported on Windows, Linux, and macOS. Versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1 of ESP-IDF contain buffer overflow vulnerabilities. These vulnerabilities stem from an out-of-bounds read issue in the DHCP server option...

CVE-2026-34960 barebox Out-of-Bounds Read in DHCP Option Parsing

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcpmessagetype function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK...

CVE-2026-34960 barebox Out-of-Bounds Read in DHCP Option Parsing

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcpmessagetype function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK...

busybox: Fix of 4 CVEs

CVE-2018-1000517: fix heap buffer overflow in wget chunked decoding - CVE-2017-16544: reject terminal control sequences in shell tab completion - CVE-2018-20679: reject zero-length DHCP options and validate 4-byte option lengths - CVE-2019-5747: validate DHCPSUBNET option length before decoding...