The flaw in FRRouting is an improper validation of IPv6 OSPFv3 packet source and destination addresses. Without checking that packets originate from link‑local source addresses and are destined to either link‑local or multicast groups, the router accepts packets from any host. This flaw permits an attacker to forge OSPFv3 neighbor relationships, potentially altering routing tables or creating routing instability. The weakness is identified as CWE‑304.

All publicly released versions of the FRRouting routing suite are affected. The issue applies to the OSPFv3 component; any build prior to the vendor’s update that adds address validation is vulnerable.

The CVSS score of 6.1 indicates a moderate severity. EPSS is not available and the vendor has not listed the issue in CISA KEV. Based on the description, it is inferred that a remote attacker can send crafted OSPFv3 packets from any IPv6 source to the target router over the network. The lack of address checks allows the attacker to establish unauthorized adjacencies, potentially disrupting routing or exhausting CPU through repeated authentication checks. The attack surface remains significant for environments running FRRouting without additional controls.