PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-2148 Canonical CVE debrief

CVE-2016-2148 is a critical memory-corruption flaw in BusyBox's udhcpc DHCP client. The issue is described as a heap-based buffer overflow in OPTION_6RD parsing, with potential remote impact and no user interaction required. Because BusyBox is commonly embedded in appliances and Linux distributions, this is the kind of bug that can affect network-facing systems broadly if they ship a vulnerable BusyBox build.

Vendor
Canonical
Product
CVE-2016-2148
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Administrators and vendors responsible for systems that embed BusyBox, especially network appliances, embedded Linux devices, and distributions or images that include udhcpc. The NVD affected-platform data also lists Debian and Ubuntu releases, so downstream package maintainers and fleet owners should verify whether their shipped BusyBox build includes the fix.

Technical summary

NVD describes the flaw as a heap-based buffer overflow in BusyBox before 1.25.0, specifically in the DHCP client (udhcpc) while parsing OPTION_6RD. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network-reachable issue with no privileges or user interaction required and potentially severe confidentiality, integrity, and availability impact. The weakness is classified as CWE-119. NVD references a BusyBox vendor advisory and upstream patch, supporting that the issue was addressed in BusyBox project materials.

Defensive priority

High. The combination of network exposure, unauthenticated trigger conditions, and critical CVSS score makes this a priority for embedded and appliance fleets that rely on BusyBox DHCP client functionality.

Recommended defensive actions

  • Identify all products and images that ship BusyBox udhcpc, including embedded devices and custom Linux builds.
  • Verify the BusyBox version in use; NVD lists BusyBox versions up to 1.24.2 as affected, while the description states BusyBox before 1.25.0.
  • Apply the BusyBox upstream fix or upgrade to a vendor build that incorporates the patch.
  • Check downstream vendor advisories and package updates for Debian and Ubuntu systems that bundle BusyBox.
  • Prioritize external-facing or DHCP-using devices first, since the issue is network reachable and requires no user interaction.
  • If immediate patching is not possible, reduce exposure by limiting untrusted DHCP environments and monitoring affected devices for crashes or restarts.
  • Record the issue in asset and vulnerability management systems so embedded products are not missed during routine server-focused patch cycles.

Evidence notes

Primary facts come from the NVD CVE record and its referenced vendor materials. NVD describes the issue as a heap-based buffer overflow in BusyBox udhcpc during OPTION_6RD parsing, gives the CVSS 3.1 vector 9.8/CWE-119, and lists BusyBox, Debian, and Ubuntu CPEs as affected. The BusyBox advisory and upstream patch are linked in the NVD references, supporting that a vendor fix exists. No KEV entry was provided in the source corpus.

Official resources

Publicly disclosed on 2017-02-09, based on the supplied CVE published date. The NVD record was later modified on 2026-05-13, which should not be treated as the issue date.