CVE-2024-7490 is a critical buffer overflow, scored 9.8, in the example DHCP server of Microchip's Advanced Software Framework (ASF). It can allow remote code execution. There is no patch because ASF is unsupported. Replace the tinydhcp code or migrate to a maintained framework.
What's affected
The record says the issue affects Advanced Software Framework through version 3.52.0.2574. CERT/CC advisory VU#138043 says ASF 3.52.0.2574 and all previous versions are affected, and warns that multiple GitHub forks of tinydhcp may be affected too.
The vulnerable code sits in the program file tinydhcpserver.c, in the routine lwip_dhcp_find_option. It is part of an example DHCP server, so only firmware that copied or built on that example is at risk.
There is no fixed version. Microchip's statement, dated 5 August 2024, says the software is no longer supported and recommends migrating to a current, actively maintained solution. CERT/CC lists no vendor patch.
On severity there is a small difference in wording rather than a conflict. The record gives CVSS 9.8 critical (AV:N/AC:L/PR:N/UI:N). The CERT/CC page describes a stack-based overflow, while the CWE in the record is CWE-120, the classic buffer copy without size check.
How to check if you're exposed
ASF is source code that ends up compiled into firmware, so look in your embedded repositories.
- Search your firmware source for the file name tinydhcpserver.c and the function name lwip_dhcp_find_option.
- Look for an ASF directory in vendored third-party code and read its version string. Anything at or below 3.52.0.2574 is in range.
- Check forks and copies. CERT/CC says forks of tinydhcp may carry the same flaw, so a missing ASF folder does not clear a project.
- Confirm whether the DHCP server is actually enabled in your build configuration and reachable on a network you do not control.
An SBOM or dependency inventory makes step 2 faster across many repositories. See how that looks in the demo below.
Click through it at your own pace, or open it full screen.
What to do now
- Inventory every product that includes ASF or a tinydhcp fork.
- Disable the example DHCP server in any build that does not need it.
- Where a DHCP server is needed, replace tinydhcp with a maintained implementation. CERT/CC says this is the only practical option it knows of.
- Limit which network segments can reach the device's DHCP service until the replacement ships.
- Plan a migration off ASF itself, as Microchip recommends.
Why it matters
The weakness is a buffer overflow in code that parses DHCP options. A DHCP packet carries variable-length options, and the parser has to check each length before copying. When it does not, a crafted option can write beyond the buffer. Because DHCP is reachable without authentication, the vector needs no credentials and no user action.
The harder part is the supply chain angle. Example code gets copied into products and then forgotten. The vendor will not patch it, so every affected team has to fix its own copy. The record's KEV flag is false and neither source reports exploitation in the wild.
Quick check
Is there a patch from Microchip?
No. Microchip says ASF is no longer supported and advises migrating. CERT/CC lists no vendor patch.
Does my firmware count if it only uses a fork of tinydhcp?
Possibly. CERT/CC says multiple GitHub forks may be affected, so review the code for the vulnerable option handling.
Sources
Last reviewed: 19 October 2026.
