OpenWrt Package Management Vulnerability Affecting Multiple Versions

CVE-2020-7982

What is CVE-2020-7982?

A vulnerability affecting the opkg package manager in OpenWrt and LEDE allows for improper parsing of embedded checksums in signed repository indices. This flaw could be exploited by a man-in-the-middle attacker to inject arbitrary package payloads, which may be installed without proper verification. Users of affected OpenWrt and LEDE versions are at risk of unintentionally installing malicious code through compromised repositories.

References