PT-2026-28761 · Frrouting+2 · Frrouting Frr+2

Rensiru · Published 2026-03-30 · Updated 2026-06-03 · CVE-2026-5107

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions FRRouting FRR versions up to 10.5.1

Description A security issue exists in FRRouting FRR related to improper access controls within the EVPN Type-2 Route Handler component. The issue is located in the process type2 route function of the bgpd/bgp evpn.c file. The attack can be initiated remotely and is considered difficult to exploit.

Recommendations Deploy a patch to address this issue.

Fix

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2026-5107

OPENSUSE-SU-2026:10606-1

SUSE-SU-2026:22026-1

USN-8175-1

Affected Products

Frrouting Frr

Linuxmint

Ubuntu

References · 27

• https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045 · Patch
• https://github.com/FRRouting/frr/pull/21098 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-5107 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10606-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5107 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22026-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5107 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8175-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8175-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5107 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5107 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5107 · Security Note
• https://suse.com/security/cve/CVE-2026-28532 · Note
• https://bugzilla.suse.com/1263863 · Note
• https://twitter.com/cyberbivash/status/2038525882327769155 · Twitter Post