CVE-2025-14558 — Remote code execution via ND6 Router Advertisements
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodifi…
Published: 2026-03-09 · CVSS: 7.2 · CVSS 3.1
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7