Zephyr RTOS CVE-2025-1675

Exploitation requires the target to run the Zephyr DNS resolver code path (dns_copy_qname in dns_pack.c) and to process an attacker-influenced DNS response - i.e., the device must perform DNS resolution and the attacker must control or spoof the DNS server reply (compromised/rogue resolver or MITM on the network path). The crafted response must contain a QNAME field whose declared length exceeds the actual source buffer so the unchecked memcpy over-reads. Limiting factors: devices that do not use Zephyr's native DNS client, or that only resolve against trusted on-path resolvers with no MITM exposure, are not practically reachable; impact is information disclosure of adjacent memory and/or denial of service (crash), with no integrity/code-execution impact per the vector. Per CVSS PR:N, no authentication is required.

Signals are mostly aligned but point to moderate operational priority rather than emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H = 9.1 Critical) describes an unauthenticated, network-reachable flaw with high confidentiality and availability impact and no integrity impact - consistent with CWE-125 (out-of-bounds read) causing memory disclosure and/or crash. However, EPSS is only 0.32% (55th percentile), this CVE is NOT on the CISA KEV list, and no public POC is referenced, so there is no evidence of active or imminent widespread exploitation. The high CVSS is driven by the network vector and C:H/A:H impact, but realistic exploitation depends on the Zephyr device actually performing DNS resolution and the attacker being positioned to return a crafted DNS response (malicious/compromised resolver or MITM on the network path) - a meaningful limiting factor the base CVSS does not capture. Net: a legitimately serious memory-safety bug worth patching promptly on affected Zephyr-based devices, but current exploitation-probability signals (low EPSS, no KEV, no POC) suggest it is not under active mass exploitation. No direct contradictions between the signals; the main tension is high severity versus low current-exploitation probability.

A Zephyr-based IoT/embedded device performs a DNS lookup, and an attacker who controls the responding DNS server or occupies a man-in-the-middle position on the network returns a malicious DNS response with a crafted/oversized QNAME field. When dns_copy_qname parses it, the unchecked memcpy reads past the end of the source buffer, leaking adjacent memory contents or crashing the device. No public exploit code is identified at time of analysis.