LiveActive security incident?Get immediate response
CVE Record

CVE-2025-70102: A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configura...

A NULL pointer dereference occurs in Roy Marples NetworkConfiguration/dhcpcd 10.3.0 while parsing configuration options. In parse_option() (src/if-options.c:1886), the code performs a member access on a NULL pointer of type 'struct dhcp_opt' when an unexpected/invalid option token or parsing state causes the lookup to yield NULL. The instrumented fuzzing build reports 'runtime error: member access within null pointer of type struct dhcp_opt' and aborts.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes a crash condition in dhcpcd 10.3.0 when it parses unexpected or invalid configuration option tokens. The available sources do not provide a CVSS score, vendor fix, or affected platform list, so urgency depends on whether your environment uses this specific dhcpcd version and parses untrusted or generated configuration.

Executive priority

Set this to monitor-and-inventory unless dhcpcd 10.3.0 is present on critical systems. The current evidence supports potential denial-of-service behavior, but not confirmed exploitation or broader compromise.

Technical view

The issue is reported as a NULL pointer dereference in parse_option() in src/if-options.c:1886. A lookup can return NULL for struct dhcp_opt, after which member access triggers a runtime error and abort in an instrumented fuzzing build. The bundle does not document remote reachability, privilege impact, or confirmed production exploitability.

Likely exposure

Likely exposure is limited to systems running Roy Marples NetworkConfiguration/dhcpcd 10.3.0. The source bundle does not provide CPEs, distributions, packaging details, or a complete affected-version range.

Exploitation context

No active exploitation is supported by the provided sources. The CVE is not listed as KEV in the bundle, and the report describes a fuzzing-discovered abort rather than a documented in-the-wild attack.

Researcher notes

Key gaps are severity, affected-version range, reachability, and vendor remediation. The source evidence points to NULL member access during option parsing in a fuzzing context. Avoid assuming remote exploitability without additional vendor or researcher confirmation.

Mitigation direction

  • Inventory systems and containers for dhcpcd 10.3.0.
  • Check the dhcpcd project or OS vendor guidance for fixed releases.
  • Restrict dhcpcd configuration changes to trusted administrators.
  • Treat generated or third-party dhcpcd configuration as higher risk until reviewed.

Validation and detection

  • Confirm installed dhcpcd versions through package inventory or SBOM data.
  • Identify systems that parse custom dhcpcd configuration options.
  • Review crash logs for dhcpcd aborts during configuration parsing.
  • Track the CVE record for severity, affected-version, and remediation updates.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-70102 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.