A local network attacker can trigger an integer underflow (CWE‑191) in the Emergency Access Daemon’s handle_send_a function by sending a single crafted UDP packet. The packet length value underflows before a bounds check, causing a very large value to be passed to memcpy and crash the daemon. The result is a denial of service; the daemon becomes unavailable and normal administrative access through the daemon is interrupted. No code execution or data exfiltration is possible.

OpenWrt routers running any version prior to 25.12.5 are affected. The vulnerability resides in the OpenWrt openwrt product, specifically within the Emergency Access Daemon component. Devices updated to v25.12.5 or later receive the fix that prevents the integer underflow.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% suggests exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is local network; an attacker only needs the ability to send UDP traffic to the device. With no authentication required, the risk remains moderate, but the impact is limited to service disruption of the daemon only.