Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
Summary: Cisco Talos researchers traced a missing size check in an unescape function - one that assumes two bytes always follow a '%' and can read past the end of a string via strcpy's s+3 - to a code fragment carrying a Broadcom copyright, then found the same flaw in FreshTomato, DD-WRT, Asuswrt and Asuswrt-Merlin, and ArduPilot APWeb. Talos disclosed the issues as TALOS-2022-1509 through TALOS-2022-1512; the FreshTomato, Asuswrt and ArduPilot flaws were patched, while the DD-WRT flaw was confirmed present from revision 32270 to at least revision 48599 and was unpatched at the time of publishing.
Why it matters: A single unchecked line from what appears to be a Broadcom reference HTTP server implementation reached an open-source autonomous vehicle package with no Broadcom tie at all, and the DD-WRT variant remained unpatched across at least 16,000 revisions - so the vulnerable code is likely sitting in products nobody has inventoried.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026