A critical vulnerability has been identified in Microchip’s Advanced Software Framework (ASF), which could allow for remote code execution (RCE) facilitated by a stack-based overflow in the implementation of the “tinydhcp” server. This flaw, tracked as CVE-2024-7490, stems from inadequate input validation of DHCP requests, carrying a high CVSS score of 9.5/10 and affecting ASF version 3.52.0.2574 and earlier versions. The CERT Coordination Center (CERT/CC) at Carnegie Mellon University issued an advisory warning that the vulnerability could be widely present in IoT devices due to its nature. The vulnerability remains unpatched, and CERT/CC recommends replacing the tinydhcp service to mitigate the risk, as the affected ASF version is no longer supported. Additionally, forks tinydhcp projects on GitHub could be similarly impacted. The disclosure of this flaw aligns with another serious vulnerability in MediaTek Wi-Fi chipsets (CVE-2024-20017), which also allows for RCE. Although MediaTek released a patch in March 2024, the risk of exploitation has increased following the release of a proof-of-concept (PoC) exploit in August 2024. Both vulnerabilities highlight significant security concerns in IoT and networking technologies. CTIX analysts urge all affected users to follow the CERT/CC guidance and replace the tinydhcp service with another one that is not vulnerable to this exploit.