Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63201— netopeer2-server logging has format string vulnerability via subtree filter

Quick assessment

Affected
CESNET netopeer2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Netopeer2 是一款基于 NETCONF 协议实现网络配置管理的服务器。在受影响的版本中，低权限的已认证 NETCONF 用户可以通过发送包含格式说明符（format specifiers）的无效子树过滤器（subtree filter）的 请求，远程导致 崩溃。 在 文件中， 函数将无效值通过 宏传递给 ，后者首先使用 安全地格式化消息。然而，在 中，该已格式化的缓冲区随后被作为格式字符串本身传递给 ，导致 将攻击者控制的百分号序列（如 、 等）解释为格式说明符，并尝试读取无效的指针参数，从而引发崩溃。 该

CVSS 7.1 · High EPSS 0.43% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
CESNET netopeer2 < 2.8.21 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63201

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netopeer2-server logging has format string vulnerability via subtree filter
Source: CVE Program / CVE List V5
Vulnerability Description
Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部控制的格式字符串
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
CESNET netopeer2 < 2.8.21 -

II. Public POCs for CVE-2026-63201

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63201

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63201 (1)

Vendor Advisories for CVE-2026-63201 (1)

Vendor Pages for CVE-2026-63201 (1)

IV. Related Vulnerabilities

Same vendor: CESNET
Same weakness: CWE-134