{"schema":"threatline.record/2","record":{"id":"CVE-2026-104114","aliases":[],"summary":"NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon","details":"A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.","categories":["Unclassified"],"product":"illumos-gate","vendor":"illumos","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104114","source_modified_at":"2026-10-09T16:45:28.800Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"illumos-gate","vendor":"illumos","versions":[{"status":"affected","version":"6ba597c56d749c61b4f783157f63196d7b2445f0","lessThan":"0f1064d97f1a43778ddf87d4e438b99872aed1a0","changes":[{"at":"0f1064d97f1a43778ddf87d4e438b99872aed1a0","status":"unaffected"}],"versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104114","source_modified_at":"2026-10-09T16:45:28.800Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"OmniOS","vendor":"OmniOS","versions":[{"status":"affected","version":"any","lessThan":"r151054","versionType":"custom"},{"status":"affected","version":"r151058","lessThan":"r151058w","changes":[{"at":"r151058w","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151056","lessThan":"r151056aw","changes":[{"at":"r151056aw","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151054","lessThan":"r151054bw","changes":[{"at":"r151054bw","status":"unaffected"}],"versionType":"custom"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104114","source_modified_at":"2026-10-09T16:45:28.800Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"illumos-gate","ecosystem":null},"version":"0f1064d97f1a43778ddf87d4e438b99872aed1a0","basis":"first unaffected version stated in the CVE record"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00116,"percentile":0.01532,"score_date":"2026-10-23"},"published_at":"2026-10-09T14:22:14.611Z","modified_at":"2026-10-09T16:45:28.800Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104114","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T16:45:28.800Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104114","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers","tags":["mailing-list"]},{"source":"CVE List","url":"https://illumos.org/issues/18495","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/illumos/illumos-gate/commit/0f1064d97f1a43778ddf87d4e438b99872aed1a0","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-09T16:15:16.599352Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T16:45:28.800Z","content_hash":"1fc58f10c2f02cfbd216cb9e11206406e82b9e91f497004f3c7fd7167680cf85"}}