EUVD-2026-43699Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LwM2M server role or on-path position on weak/no DTLS
-
DeliveryWRITE 128-254 char URI to /5/0/1
-
ExploitTruncated non-terminated copy into context.uri
-
Executionstrlen/URL parsing over-reads adjacent memory
-
PersistOver-read bytes appended to outbound CoAP request
-
ImpactLeak device memory to server or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the device to be built with the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT firmware-pull feature (Zephyr 3.0.0-4.4.0), and requires the attacker to write the Firmware Update Package URI resource /5/0/1 with a string 128-254 characters long. Concretely that means occupying the role of the LwM2M management server - normally an authenticated (D)TLS peer authorized to write device resources - OR being an on-path attacker on a LwM2M session that lacks strong DTLS protection. Limiting factors: devices without the pull-support Kconfig option are not affected; a session protected by properly configured mutual DTLS blocks the on-path variant and leaves only a compromised/malicious authorized server as the vector; and the impact is limited to memory over-read (disclosure of adjacent static memory and device crash), not code execution or data modification. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) treats this as remote, unauthenticated, low-complexity - but that scoring is generous relative to the described attack model, which requires the attacker to occupy the position of the LwM2M management server (an authorized, typically DTLS-authenticated write to /5/0/1) or to be on-path on a session lacking strong DTLS. In practice the prerequisite is a malicious/compromised management server or a downgraded/weak transport, which is closer to PR:L or AC:H than PR:N - verify the trust model against your deployment. The corroborating signals argue against panic: EPSS is 0.28% (20th percentile), there is no CISA KEV entry, and SSVC records Exploitation=poc, Automatable=yes, Technical Impact=partial. The 'partial' technical impact and low EPSS align with a read-only over-read (no code execution, no integrity impact) whose worst outcomes are memory disclosure to the managing server and device crash, rather than full takeover. Net: a genuine, patch-worthy memory-safety bug for fielded IoT devices, but the real-world priority is moderate - driven by the plausibility of a rogue/compromised LwM2M server or unprotected DTLS in your fleet, not by the raw 9.1. |
| Exploit ScenarioDerived | A LwM2M management server that has been compromised, or an attacker positioned on-path against a device whose LwM2M session lacks strong DTLS, issues a WRITE to the Firmware Update Package URI resource (/5/0/1) containing a URI of 128-254 characters. The device copies only the first 128 bytes with no terminator, then strlen/URL parsing walks into adjacent static memory; those over-read bytes are appended to the device's next outbound CoAP request back to the server (leaking device memory) or trigger a fault that crashes the device. Per the SSVC framework a proof-of-concept exists and the technique is automatable, though no active exploitation is recorded in CISA KEV. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 06, 2026
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Earlier versions of this analysis (1)
Out-of-bounds memory read in the Zephyr RTOS LwM2M firmware-update pull client (subsys/net/lib/lwm2m/lwm2m_pull_context.c) lets a LwM2M management server — or an on-path attacker on a session lacking strong DTLS — leak adjacent device memory and crash the device by writing an over-length Package URI (resource /5/0/1). Affected releases span v3.0.0 through v4.4.0 with the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path enabled. No public exploit identified at time of analysis; a vendor patch is available and EPSS/KEV signals are absent.
RemediationAI
Vendor-released patch: Zephyr 4.5.0 - upgrade affected devices from any 3.0.0-4.4.0 build to 4.5.0 or later, or backport commit 99a164df5cea5af76e32b57c6d51854f018969a2, which adds a strlen(uri) >= sizeof(context.uri) guard returning -ENOMEM and replaces memcpy with strcpy to guarantee a bounded, NUL-terminated buffer. If you cannot rebuild firmware immediately, the most direct compensating control is to disable the firmware pull path by unsetting CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT (trade-off: over-the-air pull-style FOTA via LwM2M is lost, so plan an alternative update mechanism); alternatively enforce strong, mutually-authenticated DTLS on all LwM2M sessions and restrict which management servers may write resource /5/0/1, which closes the on-path/rogue-server vector without removing FOTA but does not protect against an already-trusted-but-compromised server. Where feasible, also constrain or validate Package URI length before it reaches the device. Full details are in advisory GHSA-rf6j-4mpp-j9mf (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Zephyr's Lightweight M2M (LwM2M) implementation, a UDP/CoAP-based device-management protocol (OMA LwM2M) commonly secured with DTLS. The firmware-update 'pull' mechanism (object /5, Firmware Update; resource /5/0/1, Package URI) downloads firmware from a URI the management server writes into the device. The root cause is CWE-125 (out-of-bounds read) arising from an unterminated string: subsys/net/lib/lwm2m/lwm2m_pull_context.c performed memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size (CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with no length check and no NUL termination, even though the source Package URI buffer holds up to 255 bytes. The truncated, non-terminated buffer is then treated as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), by strlen-based CoAP URI-Path/Proxy-URI option appends, and by lwm2m_parse_peerinfo(), so parsing runs past the 128-byte buffer into adjacent static memory. The over-read bytes are copied into outbound CoAP requests to the server/proxy (information disclosure) and can fault the device (denial of service). The bug was introduced by the pull-context refactor first released in v3.0.0; the CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* confirms the Zephyr project as the affected product.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network vector, but exploitation needs an authorized LwM2M server session (or weak-DTLS on-path), so PR:L; over-read yields high confidentiality/availability impact and no integrity change.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.
Executive ViewAI
A memory disclosure and denial-of-service vulnerability in Zephyr RTOS 3.0.0-4.4.0 affects firmware-update components enabled by default, exposing adjacent device memory and enabling remote crashes. Exploitation requires either compromise of the LwM2M management server or man-in-the-middle access to weak DTLS sessions; organizations operating IoT or embedded systems in LwM2M-managed environments face data leakage risk and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB