netopeer2-server logging has format string vulnerability via subtree filter
netopeer2-server is affected, with version 2.8.7 confirmed affected in testing. The vulnerability is fixed in netopeer2-server 2.8.21, and no vendor severity rating is given beyond the CVSS score of 7.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.8.21
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A low-privileged authenticated user of the netopeer2-server, a NETCONF network configuration management server, can crash the server by sending a get request with a specially crafted subtree filter containing format specifiers, causing a denial of service. Remote code execution was not confirmed.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CESNET netopeer2
fixed in 2.8.21
References 3
GitHub · CESNET/netopeer2
Questions about CVE-2026-63201
What does this mean?
A get RPC with an invalid subtree filter whose text contains format specifiers, such as %s%s%s%s, can crash the netopeer2-server process. The confirmed impact is denial of service, and reliable remote code execution was not confirmed.Source: github.com
Am I affected, and how do I check?
Version 2.8.7 of netopeer2-server was confirmed affected, and the fixed range begins at 2.8.21. Compare the installed netopeer2-server version with that fixed version to see where it falls.Source: github.com
What should I do about it?
Upgrade netopeer2-server to version 2.8.21 or later, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data