CVE-2024-7490: Microchip Advanced Software Framework tinydhcp Server Stack Overflow (RCE)

CVE-2024-7490 is an improper input validation flaw (CWE-120, classic stack-based buffer overflow) in the tinydhcp example DHCP server that ships as part of Microchip's Advanced Software Framework (ASF), a C library for AVR and SAM microcontrollers commonly compiled directly into IoT and embedded device firmware; a single crafted DHCP request packet can overflow a fixed-size stack buffer in the option-parsing routine and, per CERT/CC, lead to remote code execution, and NVD's own analysis rates this CVSS v3.1 9.8 (critical).

CVE-2024-7490 (CWE-120, buffer copy without checking size of input) affects the tinydhcpserver.c example DHCP server distributed as part of Microchip Technology's Advanced Software Framework (ASF), a software library for AVR and SAM32 microcontrollers that vendors routinely compile directly into device firmware rather than install as a system package. NVD's description states: "Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer overflow. This vulnerability is associated with program files tinydhcpserver.C and program routines lwip_dhcp_find_option. This issue affects Advanced Software Framework: through 3.52.0.2574. ASF is no longer being supported. Apply provided workaround or migrate to an actively maintained framework" (NVD).

NVD's own Primary analysis scores this CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction, with high impact to confidentiality, integrity and availability (NVD).

CERT/CC's coordinated vulnerability note VU#138043 gives the root cause and reach of the bug: "A stack-based overflow vulnerability exists in the tinydhcp server in the Microchip Advanced Software Framework (ASF) that can lead to remote code execution. An implementation of DHCP in ASF fails input validation, thereby creating conditions for a stack-based overflow. The software is no longer supported by the vendor. Because this vulnerability is in IoT-centric code, it is likely to surface in many places in the wild," and notes the flaw "can be tested by sending a single DHCP Request packet to a multicast address," with CERT/CC adding that "multiple forks of the tinydhcp software in github... are also potentially susceptible" (CERT/CC VU#138043). CERT/CC's own references point to the affected file inside ASF's bundled lwIP tiny-services tree, thirdparty/lwip/lwip-tinyservices/tinydhcpserver.c (CERT/CC VU#138043).

Microchip's vendor statement, recorded in the same CERT/CC note, confirms there is no fix coming: "This software solution is no longer being supported by Microchip. Any remediation action will be to migrate to a current software solution that is under active maintenance from us" (CERT/CC VU#138043, Microchip ASF page).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0138 (72.181st percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).

Because ASF's tinydhcp code has been reused across "multiple forks" on GitHub and ASF itself is end of life with no planned patch, the only durable fix for a device built on this code path is to remove the tinydhcp server and replace it with an actively maintained DHCP server implementation, as Microchip itself recommends; firmware teams that can only identify the component by its source (rather than a version number) should search their build tree for tinydhcpserver.c or the lwip_dhcp_find_option routine name.

• The tinydhcp example DHCP server in Microchip's Advanced Software Framework, through 3.52.0.2574, fails input validation in tinydhcpserver.C / lwip_dhcp_find_option, causing a buffer overflow that can lead to remote code execution; ASF is no longer supported. — NVD
• NVD's own Primary analysis scores this CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
• CERT/CC VU#138043 identifies this as a stack-based overflow in tinydhcpserver.c under ASF's bundled lwIP tiny-services tree, triggerable with a single crafted DHCP Request packet, and notes multiple GitHub forks of tinydhcp are potentially susceptible. — CERT/CC VU#138043
• Microchip's vendor statement confirms ASF is no longer supported and recommends migrating to an actively maintained software solution instead of a patch. — CERT/CC VU#138043
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0138 (72.181st percentile) as of 2026-11-06. — FIRST EPSS