CVE-2020-28194

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-01 · updated 2026-06-17
Weakness: CWE-191

Description

Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.

Affected products

https://accel-ppp.org/ Accel-PPP: before 1.12.0-e9d369a — fixed in 1.12.0-e9d369a

How to fix

Upgrade to a fixed version: https://accel-ppp.org/ Accel-PPP 1.12.0-e9d369a. Check the vendor advisory for mitigations.

References

https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69
https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr
https://github.com/accel-ppp/accel-ppp/commit/e9d369aa0054312b7633e964e9f7eb323f1f3d69
https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-2m44-rh3c-x4gr

Get alerted when CVE-2020-28194 or the next vulnerability affects your stack