CVE-2024-7490

The vulnerability results from improper input validation (CWE-120 — classic buffer overflow) in the tinydhcpserver.C files and the lwip_dhcp_find_option function. An attacker can remotely, without authentication, send crafted DHCP packets that cause a buffer overflow in the vulnerable DHCP option handling routine. The buffer overflow allows overwriting memory areas and hijacking program execution flow control.

An attacker can gain the ability to execute arbitrary remote code (RCE) on a device running the vulnerable DHCP server, which may lead to complete system takeover and pose a threat to dependent environments.

The manufacturer does not plan to release a patch — Microchip Advanced Software Framework is no longer actively developed. Available workarounds indicated by the manufacturer should be applied, or migration to an actively maintained framework should be performed as soon as possible. Workaround details are available at: https://www.kb.cert.org/vuls/id/138043

Microchip Advanced Software Framework in all versions up to and including 3.52.0.2574, using the sample DHCP server (files tinydhcpserver.C, function lwip_dhcp_find_option).