CVE-2023-5324

MEDIUM

eeroOS < 6.16.4-11 - Denial of Service via Ethernet Interface

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-5324. PoCs published by nomis.

AI-analyzed exploit summary This PoC demonstrates a DoS vulnerability in eeroOS by sending a malformed IPv6 packet with a zero-length payload and invalid hop-by-hop/destination options headers, causing the Ethernet interface to stop receiving packets.

Description

A vulnerability has been found in eeroOS up to 6.16.4-11 and classified as critical. This vulnerability affects unknown code of the component Ethernet Interface. The manipulation leads to denial of service. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241024.

Exploits (1)

nomisec WORKING POC 1 stars
by nomis · poc
https://github.com/nomis/eero-zero-length-ipv6-options-header-dos

This PoC demonstrates a DoS vulnerability in eeroOS by sending a malformed IPv6 packet with a zero-length payload and invalid hop-by-hop/destination options headers, causing the Ethernet interface to stop receiving packets.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: eeroOS v6.9.0 and later
No auth needed
Prerequisites: Network access to the target eero device · Ability to send raw packets on the local network
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.241024
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.241024

Scores

CVSS v3 4.3
EPSS 0.0081
EPSS Percentile 52.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (1)
eero/eeroos < 6.16.4-11
Published Oct 01, 2023
Tracked Since Feb 18, 2026