CVE-2026-5107

Katalog CVE

CVSS 4.2 · Medium EPSS 0,37%

Kerentanan Incorrect Privilege Assignment pada frrouting. Skor CVSS 3.1 4.2 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045 patch
• https://github.com/FRRouting/frr/pull/21098 issue tracking · patch
• https://vuldb.com/submit/780123 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/354132 advisory pihak ketiga · vdb entry
• https://github.com/FRRouting/frr/ product
• https://vuldb.com/vuln/354132/cti permissions required · vdb entry