Zephyr hawkBit CVE-2026-10849

The hawkBit OTA management client must be compiled into the Zephyr firmware image (CONFIG_HAWKBIT=y) and actively polling a hawkBit update server. The attacker must be able to control what the device receives as the HTTP response body from the update server - either by directly operating a malicious hawkBit server the device is configured to contact, by compromising the legitimate update server, or by performing a man-in-the-middle attack on the HTTP channel (TLS is optional and not mandatory for hawkBit deployments). Even with TLS enabled, a hostile server (e.g., a compromised update server) can trigger the flaw because TLS authenticates the channel but not the server's intent. No special device-side privilege or user interaction is required once the device initiates an update poll. Exploitation is limited to denial of service in typical configurations because the attacker-controlled payload is only a single NUL byte; arbitrary code execution would require additional heap-layout conditions specific to the allocator and firmware.

The provided CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects network reachability and no device-side authentication requirement, with impact limited to availability - the single NUL byte write corrupts allocator metadata rather than injecting attacker-controlled bytes, constraining impact to heap corruption and DoS. The EPSS score of 0.27% at the 18th percentile is markedly low despite the high CVSS score, consistent with the niche deployment footprint of Zephyr hawkBit in IoT firmware. SSVC reports Exploitation: none and Technical Impact: partial, confirming no observed active exploitation and bounded impact. The vulnerability is not listed in CISA KEV. The key real-world constraint is that the attacker must control or MitM the hawkBit update server the device communicates with - this is a meaningful barrier above a pure unauthenticated network attack, though TLS being optional and not protecting against a hostile server is a significant gap. For devices using hawkBit OTA over untrusted network paths without certificate pinning, this is a genuine priority; for deployments on air-gapped or fully controlled update infrastructure, risk is substantially reduced.

An attacker who has compromised a hawkBit update server, or who performs a man-in-the-middle attack on a device communicating with the update server over plain HTTP, crafts an HTTP response body whose length equals or exceeds the current heap allocation in the device's hawkBit client. When the Zephyr device processes the response, response_json_cb() writes a NUL terminator one byte past the heap object, overwriting adjacent allocator metadata or the next heap chunk header. On the next allocation or free operation, the corrupted metadata causes a fault, crashing the device and triggering a reboot - achieving denial of service against embedded IoT devices relying on this OTA mechanism.