Description
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
Published: 2026-10-30
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

A low‑privileged authenticated NETCONF user can send a malformed get RPC request with a subtree filter that contains format specifiers. The server logs the invalid value as a format string, causing ‘vsyslog’ to interpret attacker‑controlled sequences and read invalid memory addresses, which crashes the netopeer2‑server process. The crash only results in denial of service; reliable remote code execution has not been demonstrated.

Affected Systems

The vulnerability affects the CESNET netopeer2 server, specifically all 2.8.x releases up to and including 2.8.7. The fix is contained in unreleased 2.8.8 and confirmed in the public 2.8.21 release. Systems running those affected versions are susceptible.

Risk and Exploitability

The CVSS v3.1 score of 7.1 indicates medium severity, and the EPSS score is unavailable. The problem is not listed in CISA’s KEV catalog. Exploitation requires an authenticated NETCONF session, but only a low‑privilege user is sufficient; thus the attack vector is remote over a standard LAN or wired/TCP connection on the NETCONF port.

Generated by OpenCVE AI on October 30, 2026 at 23:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to netopeer2 version 2.8.21 or later to apply the vendor patch
  • If an immediate upgrade is not possible, restrict NETCONF access to trusted hosts or disable low‑privileged user accounts
  • Consider reducing or disabling syslog logging for error messages that contain user‑supplied data as a temporary containment measure

Generated by OpenCVE AI on October 30, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
Title netopeer2-server logging has format string vulnerability via subtree filter
Weaknesses CWE-134
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T22:03:18.551Z

Reserved: 2026-07-15T22:19:06.905Z

Link: CVE-2026-63201

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T22:16:58.637

Modified: 2026-10-30T22:16:58.637

Link: CVE-2026-63201

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T23:30:15Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String