Skip to main content
CVE-2026-54634VulnerabilityPublished Updated

SUSE · Security update for hamlib

Affects SUSESource GCVE Database

0
Compare

Not known to be exploited · fixed in SUSE package updates : update SUSE when convenient.

Data as of 10 Nov 2026, 20:06 UTC

Severity
Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 4.7.2

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 23 Jun 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Description

This update for hamlib fixes the following issues: Changes in hamlib: - Update to 4.7.2: * Fix IC-7600/IC-7610 clock commands * Icom: Add CWR to modes eligible for DSP filtering * Kenwood: New model Hamgeek uSGX * Various fixes for Skywatcher, DX-SR8, FT-710, FTX-1, IC-705, X6100 * rigctld: Fix send_raw stack out-of-bounds write and uninitialized memory CVE-2026-54634 (boo#1268628) * rigctld: Fix stack/heap overflow primitive in read_string_generic + auth bypass in rigctld + weak password handling (boo#1268629) - Update to 4.7.1: * Various compiler and portability fixes * Fix rig port timeout * Fix various FTX-1 meter, level and CTCSS table * Add power off capability to Flrig backend * Add SWR to supported 'get levels' for K3/K4 * Add get_split_vfo to TS-850 backend * New simplecat backend * Fix and generalize clock handling for Icom radios * Fix Yaesu attenuator levels and LVL_KEYSPD reinitialization * Add new rig model Harris PRC-138 * Various FT-710 fixes, eespecially handling SH format and RX bandwidth * Ensure FT-710 simulator rejects RF command * Fix low power calculation for K3/K3S * Fix FTX-1 SH bandwidth command in set/get_mode - Update to 4.7.0: * Revamp Kenwood voice memory handler - Fixes TS-890S & TS-990S * libusb is now detected using the pkg-config facility. * Functions rig_get_conf, rot_get_conf, amp_get_conf deprecated use *_get_conf2() instead * rig_set_trn and rig_get_trn deprecated. * Many fixes for SWIG binding generation and improved Python support and testing * Fix AGC for IC-R75, fix AGC for all Icom rigs * New Drake R8 backend * New AF6SA WRC rotator backend * New Yaesu FTX-1 model support (alpha) * Update QRPLabs QMX backend for max serial rate of 230400 bps * Updates to Icom IC-F8101 * New rig model Icom ID-52A/W Plus * Fix memory leaks in rigctld and rigctltcp * Fix Skywatcher backend for firmware that doesn't echo commands * Additional Yaesu FTX-1 capabilities * Add extended commands for the IC-7300MK2-- * Revert updating FLRig model name * Add manual pages for rigctltcp, rigtestlibusb, rigtestmcast, and rigtestmcastrx * Pause building rigfreqwalk as the code does not align with the required commandline parameters * Developer visible changes, code moves and refactoring - Update to 4.6.5: * Update Kenwood CW buffer max message size, fix one byte buffer overrun * Fix segmentation Faults

References

Community reviews

Loading reviews…