Attack Chain

1. Attacker identifies a target embedded system running a vulnerable version of BusyBox with the DHCPv6 client enabled.
2. The attacker crafts a malicious DHCPv6 response packet.
3. The crafted packet includes a D6_OPT_DNS_SERVERS option with a size that exceeds the expected buffer allocation.
4. The attacker transmits the crafted DHCPv6 response packet to the target system on the local network.
5. The target system’s udhcpc6 client receives the malicious DHCPv6 response.
6. The udhcpc6 client processes the D6_OPT_DNS_SERVERS option, triggering the vulnerable option_to_env() function.
7. The option_to_env() function calculates an insufficient buffer size based on the malformed option.
8. A heap buffer overflow occurs when copying the oversized DNS server list, leading to memory corruption, denial-of-service, or arbitrary code execution.

Impact

Successful exploitation of CVE-2026-29004 can have severe consequences. A denial-of-service condition could disrupt the functionality of the affected embedded system. More critically, arbitrary code execution allows attackers to gain complete control over the device, potentially leading to data theft, device compromise, or use in botnet activities. Given BusyBox’s prevalence in embedded systems, a large number of devices are potentially vulnerable.

Recommendation

• Apply the patch addressing CVE-2026-29004 by updating to a version of BusyBox after commit 42202bf.
• Deploy the Sigma rule “Detect Suspicious DHCPv6 DNS Server Option Size” to identify potentially malicious DHCPv6 responses in network traffic.
• Monitor network traffic for unusually large DHCPv6 DNS_SERVERS options as indicated by the Sigma rule and network connection logs.