A NULL pointer dereference in the illumos Network Auto‑Magic daemon (nwamd) allows a local user to crash the daemon. The flaw occurs in nwamd_door_switch(), which writes to the caller’s request structure before validating that a request was supplied and before checking the caller’s credentials. When an unprivileged user issues a door_call() with no argument data, nwamd crashes. Repeated crashes put the svc:/network/physical:nwam service into maintenance, preventing automatic network configuration. The flaw has existed since 2010 and is present in any illumos distribution prior to the illumos‑gate commit that fixed the issue.

The vulnerability affects illumos‑based distributions, specifically OmniOS and illumos‑gate, for all versions released before the 0f1064d9 commit identified in the illumos‑gate repository. Any sandbox or host running the nwamd daemon with the default svc:/network/physical:nwam service enabled is susceptible.

The CVSS score of 5.4 indicates a moderate impact; EPSS information is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local, requiring only local user access to the system. An attacker with local privileges can repeatedly crash nwamd, causing service disruption and disabling automatic network setup, which may lead to denial of connectivity for applications that rely on the nwamd service.