SWUpdate CVE-2026-28525

Requires that the SWUpdate Mongoose-based web upload interface is enabled and network-reachable, with the attacker able to reach the /upload endpoint over HTTP. Exploitation specifically needs a malformed multipart boundary AND attacker-controlled TCP stream timing so that the receive buffer length io->len falls below boundary.len + 8, landing in the narrow range that causes the size_t subtraction to underflow. No authentication is required (PR:N), but the attack is limited by high complexity: the buffer length must be coerced into a specific range via precise stream timing, and devices that do not expose the web upload interface (or expose it only on isolated networks) are not remotely reachable. Impact is limited to availability (denial of service) - no code execution or data disclosure is indicated.

The signals converge on a genuine but non-urgent issue. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) shows network reach with no authentication, but AC:H reflects the real constraint: exploitation depends on landing the buffer length in a narrow range and controlling TCP stream timing, which is not trivially repeatable. Impact is confined to availability (VC:N/VI:N/VA:H) - no confidentiality or integrity loss - matching a DoS classification. Corroborating this, EPSS is 0.03% (10th percentile), CISA SSVC lists Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no KEV listing and no known POC. The score of 8.2 is driven largely by the unauthenticated network vector; in practice the high attack complexity, availability-only impact, and the fact that the HTTP upload interface is not always enabled or internet-exposed on embedded devices lower the real-world priority. No conflicting data was identified; the main uncertainty is whether a given deployment exposes the /upload endpoint.

An attacker with network reach to a device's SWUpdate web interface sends a crafted HTTP POST to /upload using a malformed multipart boundary, then manipulates TCP segment timing so the buffered length falls into the vulnerable range and triggers the integer underflow. The resulting out-of-bounds read corrupts data delivered to the local IPC socket and crashes or destabilizes the update service, denying update functionality. No public exploit is known, and the required timing control (CVSS AC:H) makes reliable triggering non-trivial.