LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28951: libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using maliciou...

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE affects OpenWrt’s libuci component. Older OpenWrt versions may mishandle malicious package names and trigger a use-after-free memory error. The bundle does not prove remote exploitation, active attacks, or business impact beyond affected OpenWrt systems needing version review and updates.

Executive priority

Prioritize identification and update of exposed OpenWrt assets, especially managed routers or embedded devices. Urgency is constrained by incomplete public evidence: the issue is memory-safety related, but no active exploitation or CVSS severity is provided in the bundle.

Technical view

libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use-after-free when handling malicious package names. The CVE ties this to uci_parse_package in file.c and uci_strdup in util.c. No CVSS, CWE, CPE, or exploit mechanics are provided.

Likely exposure

Exposure is likely limited to OpenWrt systems or custom builds using affected libuci code before OpenWrt 18.06.9 or 19.07.5. Risk depends on whether malicious package names can reach libuci processing paths.

Exploitation context

The source bundle does not cite active exploitation, KEV listing, exploit availability, attack vector, required privileges, or user interaction. Treat exploitation status as unconfirmed.

Researcher notes

Evidence is sparse. The CVE identifies affected OpenWrt release ranges and specific libuci functions, but not impact, exploitability, or reachability. Researchers should inspect the referenced OpenWrt and uci commits and validate whether local deployment workflows expose package-name parsing to untrusted input.

Mitigation direction

  • Upgrade OpenWrt 18.06 deployments to 18.06.9 or later.
  • Upgrade OpenWrt 19.x deployments to 19.07.5 or later.
  • Apply OpenWrt or vendor updates that include the referenced libuci fix.
  • For custom firmware, check vendor guidance before backporting fixes.
  • Limit processing of untrusted package names until affected systems are updated.

Validation and detection

  • Inventory OpenWrt versions across routers, appliances, and custom images.
  • Flag OpenWrt before 18.06.9 and 19.x before 19.07.5.
  • Verify custom builds include the referenced libuci fix commit.
  • Confirm updated devices run expected firmware after maintenance.
  • Review crash reports for libuci-related failures, without assuming compromise.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-28951 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.