A critical Denial of Service vulnerability in FRRouting (frr) versions 4.0 through 10.4.1 allows unauthenticated remote attackers to crash routing services via malformed OSPF packets.

This flaw is a NULL pointer dereference vulnerability residing in the show_vty_ext_link_rmt_itf_addr function within ospf_ext.c. Attackers can trigger this condition without authentication by sending a specially crafted OSPF packet to the target system.

The vulnerability carries a CVSS score of 7.5, reflecting its high impact on service availability. Successful exploitation results in a Denial of Service, which can disrupt network routing operations, impact connectivity, and cause significant downtime for critical infrastructure relying on the FRRouting suite.

Immediate Action: Organizations should restrict OSPF packet reception to trusted interfaces and apply vendor-supplied security patches as soon as they become available for their specific distribution.

Proactive Monitoring: Monitor system logs for repeated OSPF process crashes or unexpected restarts, which may indicate attempted exploitation of this vulnerability.

Compensating Controls: Implement firewall rules to restrict OSPF traffic to authorized peers and isolate management interfaces from untrusted networks to prevent external exploitation.

Public Exploit Available: Yes — a public proof of concept is available via the researcher write-up referenced in the CVE record.

Given the potential for service disruption and the remote, unauthenticated nature of this vulnerability, immediate attention is required. Administrators should prioritize identifying instances of FRRouting within their environment and ensure that network-level access controls are strictly enforced until a vendor-provided patch is applied.