CVE-2018-20679

CVE-2018-20679 describes an out-of-bounds read vulnerability in BusyBox versions prior to 1.30.0, specifically within its udhcp components. This flaw allows a remote attacker to leak sensitive information from the stack by sending a specially crafted DHCP message, affecting BusyBox and Ubuntu Linux distributions. The vulnerability carries a CVSS v3 score of 7.5 (HIGH), indicating a network-based attack vector with low attack complexity and a high impact on confidentiality, but no impact on integrity or availability. Its EPSS score is low, suggesting a low probability of exploitation. Currently, there is no known active exploitation, public exploit code (e.g., Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. It is not listed in the CISA KEV catalog.