Zephyr RTOS CVE-2026-12522

Exploitation requires the ability to deliver a crafted +CGCONTRDP AT command response to the target device - achievable via a rogue LTE base station within RF range of the device, or via compromise of a network element in the upstream cellular carrier path. No device-side credentials, operator privileges, or user interaction are required; the device autonomously issues AT+CGCONTRDP=1 during every LTE network attach and unconditionally parses whatever the network returns. Limiting factors: the attacker must be co-located within RF range to operate a rogue base station (AV:A per CVSS), or must have compromised carrier infrastructure, which significantly raises the operational bar. The vulnerability is exclusive to Zephyr builds that include the HL7800 driver; devices using other modem drivers or not using the HL7800 chipset are unaffected. Devices with Zephyr stack canaries enabled (CONFIG_STACK_CANARIES) are more likely to trap the corruption as a detectable fault rather than silently allowing control-flow redirection, limiting the worst-case impact for those configurations.

The CVSS 8.8 score with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is well-grounded: adjacent-network attack vector accurately reflects the requirement to influence cellular network responses (via rogue base station or carrier-side compromise), while PR:N and UI:N are confirmed by the description - the device autonomously triggers the vulnerable code path on every LTE attach. No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, meaning real-world exploitation probability is currently unconfirmed; however, the adjacent-network vector is more accessible than it might appear in IoT field deployments, since IMSI-catcher-style rogue base station equipment is commercially available. The most significant risk amplifier is the supervisor-context execution context: on Zephyr targets without stack canaries (CONFIG_STACK_CANARIES) or memory protection (MPU/MMU), a controlled overflow can directly redirect execution rather than just crash the device. The most significant limiting factor is that the attacker must be within RF range or have carrier-network access - internet-scale mass exploitation is not feasible. No public exploit code has been identified at time of analysis, which further lowers immediate exploitation likelihood compared to the raw CVSS score.

An attacker operates a software-defined radio configured as a rogue LTE base station within RF range of a Zephyr-based IoT device that uses the HL7800 modem. When the device performs a normal LTE attach and automatically issues AT+CGCONTRDP=1, the attacker returns a crafted +CGCONTRDP response containing an address field padded to well over 64 bytes via manipulated delimiter positions. The unbounded strncpy() call overwrites temp_addr_str and adjacent supervisor-context stack memory; on devices without stack canaries, this can overwrite the return address and redirect execution to attacker-controlled code running in privileged mode.