CVE-2025-50681High· 7.5▾ Twilightigmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the `recv_igmp(…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service (application crash) via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recv_igmp() function in src/igmpproxy.c, an invalid group record type can trigger a NULL pointer dereference when logging the address using inet_fmtsrc(). This vulnerability can be exploited by sending malformed multicast traffic to a host running igmpproxy, leading to a crash. igmpproxy is used in various embedded networking environments and consumer-grade IoT devices (such as home routers and media gateways) to handle multicast traffic for IPTV and other streaming services. Affected devices that rely on unpatched versions of igmpproxy may be vulnerable to remote denial-of-service attacks across a LAN .
igmpproxy = 0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14141High· 8.8A flaw has been found in UTT 进取 520W 1.7.7-180627
CVE-2025-14140Medium· 6.5A vulnerability was detected in UTT 进取 520W 1.7.7-180627
CVE-2025-14139Medium· 5.7A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627
CVE-2025-14191High· 8.8A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114
CVE-2021-42553Medium· 6.8A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS
CVE-2022-37910Medium· 4.4A buffer overflow vulnerability exists in the ArubaOS command line interface