What is the CVSS score of CVE-2026-1677?

CVE-2026-1677 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Zephyr RTOS CVE-2026-1677

EUVD-2026-29033 MEDIUM

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') (CWE-757)

2026-05-11 vulnerabilities@zephyrproject.org

Information Disclosure Zephyr

5.3

CVSS 3.1 · Vendor: zephyrproject

Severity by source

Vendor (zephyrproject) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (zephyrproject) · only source for this CVE.

CVSS VectorVendor: zephyrproject

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 06:30 vuln.today

CVE Published

May 11, 2026 - 06:16 nvd

MEDIUM 5.3

DescriptionCVE.org

Zephyr sockets created with IPPROTO_TLS_1_3 can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via mbedtls_ssl_conf_min_tls_version). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed IPPROTO_TLS_1_3 enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-specific weaknesses. As a workaround, the TLS_CIPHERSUITE_LIST socket option can be restricted to TLS 1.3-only cipher suites.

AnalysisAI

Zephyr RTOS sockets created with IPPROTO_TLS_1_3 can negotiate TLS 1.2 connections when both TLS versions are enabled in Kconfig, because socket-level protocol selection is not propagated to mbedTLS's minimum version enforcement. Applications explicitly requesting TLS 1.3 may silently fall back to TLS 1.2, exposing them to known TLS 1.2 weaknesses such as POODLE or truncation attacks. Remote unauthenticated attackers can exploit this via network-level protocol downgrade during the TLS handshake.

Technical ContextAI

Zephyr RTOS uses mbedTLS as its underlying TLS/SSL library. When an application creates a socket with IPPROTO_TLS_1_3, Zephyr's socket abstraction layer should enforce TLS 1.3-only negotiation by calling mbedTLS's mbedtls_ssl_conf_min_tls_version() function to set the minimum version to TLS 1.3. However, this propagation does not occur. Instead, the mbedTLS configuration retains its Kconfig-specified defaults, which may include both TLS 1.2 and TLS 1.3. During the TLS handshake, the ClientHello advertises both supported versions, allowing a peer (or attacker) to select TLS 1.2. This violates the application's explicit protocol-level intent and falls under CWE-757 (Selection of Less-Secure Algorithm Before Stronger One). The root cause is incomplete socket option handling in Zephyr's TLS socket implementation.

RemediationAI

Apply the upstream patch from the Zephyr project repository that propagates socket-level IPPROTO_TLS_1_3 selection to mbedTLS by calling mbedtls_ssl_conf_min_tls_version(conf, MBEDTLS_SSL_VERSION_TLS1_3) before handshake initiation. Check the Zephyr security advisory GHSA-23r2-m5wx-4rvq for patched release versions. As an immediate workaround without patching, applications can restrict the TLS_CIPHERSUITE_LIST socket option to TLS 1.3-only cipher suites using setsockopt(), which forces the peer to negotiate TLS 1.3 or fail the handshake. This workaround has no functional side effects but requires explicit application code changes for each affected socket. Alternatively, disable TLS 1.2 at build time via Kconfig (CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=n) if the deployment does not require backward compatibility; this ensures downgrade is cryptographically impossible. Prioritize patching over Kconfig changes to avoid build-time rigidity in production deployments.