CVE-2026-2291

highpriority · track · 10EPSS 0.006 · 49 %ileexploit · PoCDEEU

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.61% (49th) EPSS

CVSS 7.3 · high

Is it mine?

24 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · ads_tec_psirt · cert_bund

EPSS · scored 2026-10-23

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedads_tec_psirt
Update to firmware IRF1000 2.3.0, IRF3000 2.3.0 or later.
Fixedweidmueller_psirt
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
Mitigationads_tec_psirt
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
Mitigationweidmueller_psirt
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.

cvss

Technical severity, 0–10. One row per scoring source.

7.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.3

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondaryexploitability 3.9 · impact 3.4

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · Weidmüller PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Psecondary · CVSS-BT (t0sche)

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · ads-tec PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USCWE-190US

exploits (1)

Public proof-of-concept and weaponised exploit code.

JianrongXiao-Linksys/dnsmasq-cve-2026Automated defect verification tool for 6 dnsmasq CVEs (CVE-2026-2291, 4890, 4891, 4892, 4893, 5172)PoC · poc_in_github

affected products (24)

Products and version ranges known to be affected.

Firmware 2.3.0 installed on DVG-IRF1401all versionsfixedads_tec_psirtDEcpe:2.3:o:ads-tec:irf1000_firmware:2.3.0:*:*:*:*:*:*:*
Firmware 2.3.0 installed on DVG-IRF3401all versionsfixedads_tec_psirtDEcpe:2.3:o:ads-tec:irf3000_firmware:2.3.0:*:*:*:*:*:*:*
Firmware >=1.0.0, <2.3.0 installed on DVG-IRF1401all versionsads_tec_psirtDEcpe:2.3:o:ads-tec:irf1000_firmware:*:*:*:*:*:*:*:*
Firmware >=1.0.0, <2.3.0 installed on DVG-IRF3401all versionsads_tec_psirtDEcpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*
Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell Avamarall versionscert_bundDEcpe:/a:dell:avamar:-
Dell NetWorkerall versionscert_bundDEcpe:/a:dell:networker:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source dnsmasq< 2.92rel2cert_bundDE
dnsmasq dnsmasq0 → 2.92rel2enisa_euvdEU

showing 20 of 24

advisories (3)

Vendor and ecosystem advisories describing this.

VDE-2026-076ads-tec Industrial IT: Multiple Vulnerabilities in ADS-TEC IRF Products2026-07-28csaf · ads_tec_psirtDE
The ADS-TEC IRF1000 and IRF3000 products are affected by multiple vulnerabilities in firmware releases prior to 2.3.0: authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware 2.3.0.
VDE-2026-081Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities2026-07-28csaf · weidmueller_psirtDE
Weidmueller security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities (CVE-2026-14167, CVE-2026-14168, CVE-2026-14169, CVE-2026-14171, CVE-2026-2291, CVE-2026-4893, CVE-2026-5172, CVE-2026-40510, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796) in firmware releases prior to V2.3.0 authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware V2.3.0.
WID-SEC-W-2026-1468dnsmasq: Mehrere SchwachstellenDeutsch2026-05-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in dnsmasq ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, beliebigen Code mit Root-Rechten auszuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und Benutzer auf bösartige Domains umzuleiten

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd ads_tec_psirt cert_bund weidmueller_psirt NVD CVE.org MITRE

published 2026-05-11modified 2026-07-20

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan