PatchTheCVECVE-2020-28194: Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with
CVE-2020-28194 is a critical-severity flaw (CVSS 9.8) affecting accel-ppp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.1% (top 12%) |
| CISA exploited list | No |
| Weakness | CWE-191 |
| Published | 2021-02-01 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-28194?
accel-ppp: upgrade to 1.12.0-e9d369a. Exact commands for each OS are on this page.
Is CVE-2020-28194 being exploited?
CVE-2020-28194 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-28194 affect?
CVE-2020-28194 affects accel-ppp. Severity is critical (CVSS 9.8). Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code
How urgent is CVE-2020-28194?
Priority 61/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-24705 CRITICAL 9.8 UPGRADE The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-
- CVE-2022-24704 CRITICAL 9.8 UPGRADE The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerabilit
- CVE-2022-0982 CRITICAL 9.8 UPGRADE The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerabili
- CVE-2021-42870 HIGH 7.5 DOWNGRADE ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
- CVE-2021-42054 HIGH 7.5 DOWNGRADE ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication