Zephyr RTOS CVE-2026-1677

Exploitation requires both of the following: (1) Zephyr application creates a socket with IPPROTO_TLS_1_3 and expects TLS 1.3 to be enforced at the protocol level; (2) Zephyr build is configured with both CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y and CONFIG_MBEDTLS_SSL_PROTO_TLS1_3=y in Kconfig. Additionally, the attacker must be a peer (direct or man-in-the-middle) capable of responding to the TLS handshake and selecting TLS 1.2 from the ClientHello. The vulnerability does NOT apply if the Kconfig disables TLS 1.2 (CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=n), or if the application never uses IPPROTO_TLS_1_3, or if the application applies the workaround (restricting TLS_CIPHERSUITE_LIST post-socket-creation). Deployment context: IoT/embedded systems using Zephyr for TLS-protected communication where TLS 1.3 was chosen for security reasons but the build retained TLS 1.2 for compatibility with legacy peers.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a low-complexity network-accessible confidentiality impact. The lack of authentication requirements and low attack complexity reflect that any remote peer can force downgrade. However, CVSS underestimates real-world risk: exploitation requires both a vulnerable Zephyr application AND a peer willing to select TLS 1.2 (typically a man-in-the-middle or passive eavesdropper who can exploit TLS 1.2 weaknesses). The CVSS confidentiality score reflects information disclosure via known TLS 1.2 attacks (e.g., POODLE, BEAST, Lucky13, Heartbleed if applicable). SSVC framing: exploitation status is unconfirmed (no KEV or POC), technical impact is moderate (crypto downgrade), automatable (network-level), affecting systems with Kconfig enabling both TLS versions. This is a design flaw rather than an acute zero-day; impact depends entirely on whether applications rely on IPPROTO_TLS_1_3 to enforce protocol version and whether the deployment environment contains attackers capable of TLS 1.2 exploitation. Organizations using Zephyr with explicit TLS 1.3 enforcement should prioritize patching if TLS 1.2 attacks (e.g., cross-site requests over compromised networks) are in their threat model.

An attacker on the same network or at a privileged network vantage point (ISP, corporate proxy) intercepts a TLS handshake from a Zephyr device attempting to establish a connection with IPPROTO_TLS_1_3. The attacker acts as a man-in-the-middle, allowing the ClientHello (advertising TLS 1.2 and 1.3) to pass, then responds with a ServerHello selecting TLS 1.2. The device accepts the downgrade because Zephyr did not enforce minimum version at the mbedTLS layer. The attacker can now exploit known TLS 1.2 attacks (e.g., POODLE to decrypt cookies, BEAST to decrypt HTTP content) to extract confidential data from the encrypted session.