A critical Denial of Service vulnerability in FRRouting allows unauthenticated remote attackers to crash routing services by sending a specially crafted OSPF packet.

The software contains a NULL pointer dereference flaw within the show_vty_unknown_tlv function located in ospf_ext.c. This issue can be triggered by an unauthenticated attacker sending a malformed OSPF packet to the target system.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to the ease of remote exploitation. Successful exploitation results in a Denial of Service, which can cause significant network instability, disruption of routing protocols, and downtime for critical infrastructure relying on the affected FRRouting instances.

Immediate Action: Update FRRouting to a version that incorporates the security fix provided in commit 88f5c06cbc1cc4d62e1cba3e7791f5cea4179ba5.

Proactive Monitoring: Monitor OSPF traffic logs for malformed packets or unusual patterns targeting the OSPF control plane. Review system logs for process crashes or service restarts associated with the frr daemon.

Compensating Controls: Implement firewall rules to restrict OSPF traffic to authorized peers only. Deploy an Intrusion Detection System (IDS) configured to identify and block malformed OSPF protocol headers.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced research write-up (https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61104.md).

Given the potential for network-wide disruption, organizations utilizing FRRouting must prioritize this update. Administrators should verify their current version against the affected range and apply the necessary patches immediately to prevent potential service instability caused by exploitation of this flaw.