EUVD-2026-84864
GHSA-rmx4-24pf-8x6h
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network reachable double free with no auth or interaction (AV:A/AC:L/PR:N/UI:N); crash-to-code-exec spread justifies high C/I/A, though A:H is the most reliable impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
AnalysisAI
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires adjacent-network access (CVSS AV:A) - the attacker must reach the device on the local or an adjacent L2 segment, not across the open internet - targeting a device whose firmware links the lwIP TCP/IP stack and exercises the vulnerable double-free code path via network input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The only quantified signal is the vendor's CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), which describes an unauthenticated, low-complexity attack requiring adjacent-network access (AV:A) with high impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and no fixed version number appears in the referenced sources, so remediation must currently be compensating rather than corrective. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all embedded devices and firmware that link the lwIP stack, identify any exposed to adjacent L2/L3 segments, and apply immediate network access controls such as ACLs, VLAN segmentation, and firewall rules to prevent unauthenticated adjacent-network access; disable unnecessary lwIP-based services and monitor for abnormal crashes or memory-related failures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates
Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today