External risk intelligence

OpenWrt mDNS Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-30871

The vulnerability exists in the mDNS (multicast DNS) daemon, which operates on UDP port 5353. While mDNS is a network service, it is designed for local link-scope communication rather than routable internet traffic. It is typically confined to a local area network (LAN) and is not intended to be exposed directly to the public internet in common, secure deployment patterns.

Buffer Overflow

Openwrt

before 24.10.625.12.0 to before 25.12.1

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the OpenWrt Project's embedded Linux operating system, specifically within the mdns daemon. The issue allows for a stack-based buffer overflow, potentially impacting the integrity and availability of affected devices. The main concern is confirming relevance and exposure within your deployed environment.

A flaw in network name resolution could allow disruption.
It affects embedded Linux systems used in networking.
Confirm if this technology is deployed and impacted.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted DNS packets to a vulnerable device. These packets, when processed by the mdns daemon, cause a buffer overflow, potentially allowing the attacker to take control of the device.

Network access required.
Triggered by PTR queries.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

The mdns daemon, which handles local network name resolution, can be vulnerable to a stack-based buffer overflow when processing specific types of DNS queries for reverse IP addresses. This vulnerability is triggered by specially crafted DNS packets received on UDP port 5353, potentially allowing an attacker to overwrite memory on the affected device.

System memory integrity.
Exploited via crafted DNS packets.
Could lead to device instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenWrt Project's mdns daemon is affected by a critical stack-based buffer overflow vulnerability. This issue is triggered by specially crafted PTR DNS queries over UDP port 5353. Teams responsible for network services, embedded device management, and the OpenWrt platform itself should collaborate on remediation. The first practical step is to identify all OpenWrt devices, confirm their network exposure, and determine business criticality to prioritize affected systems.

Identify OpenWrt deployments and exposure.
Verify device criticality and ownership.
Plan phased updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenWrt?

OpenWrt is a Linux-based operating system designed for embedded devices like routers and networking hardware. It serves as a flexible alternative to manufacturer-supplied firmware, allowing users to customize and manage network traffic, connectivity, and services on their hardware platforms.

What does CWE-121 mean for CVE-2026-30871?

CWE-121 refers to a stack-based buffer overflow. In this vulnerability, the mdns daemon attempts to copy data into a fixed-size memory area on the stack without checking the length. The process inflates certain characters during name expansion, causing the incoming data to exceed the allocated space and overwrite adjacent memory.

How is this vulnerability triggered?

The flaw is triggered when the mdns daemon processes specific PTR queries for reverse DNS domains, such as .in-addr.arpa. Incoming packets on UDP port 5353 containing these queries cause the memory overflow. Standard, non-PTR DNS traffic or queries that do not require this specific expansion do not trigger this exact buffer overflow condition.

Is my device at risk if it is not on the public internet?

According to Halo Surface Signal, this vulnerability affects the mDNS service, which uses UDP port 5353 for local network communication. Because mDNS is typically designed for local link-scope interaction rather than routable traffic, it is usually confined to your local area network (LAN) and not meant for direct public internet exposure.

How do I address this CVE?

The primary response is to update your OpenWrt software to version 24.10.6 or 25.12.1. Start by inventorying all deployed OpenWrt devices in your environment to identify which systems are running vulnerable versions. Once identified, plan a phased update to apply these patches and restore system memory integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.