Zephyr UpdateHub EUVD-2026-104599

Requires the UpdateHub FOTA client to be enabled and actively polling (CONFIG_UPDATEHUB_POLL_INTERVAL), which removes any user-interaction requirement. In the default configuration (CONFIG_UPDATEHUB_DTLS unset), start_coap_client() uses plain CoAP over UDP on port 5683 with no peer authentication and unauthenticated DNS resolution, so an on-path attacker, DNS spoofer, or an off-path attacker who wins the race with a forged source address can deliver the malformed probe response; setting CONFIG_UPDATEHUB_DTLS=y narrows the attacker to a malicious or compromised update server. The crash impact is further gated by the target: it only halts the system where the low address range (0x0) is unmapped or protected - MMU-based architectures, builds with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP, TrustZone non-secure images, and SoCs such as nRF54L - whereas on classic Cortex-M targets with a readable vector table at address zero the read succeeds and the request is simply rejected, yielding no DoS.

This is a genuine but conditional availability-only issue, not a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) is internally consistent with the description: network-reachable, no authentication (PR:N), no user interaction (polling is automatic), and high attack complexity reflecting that non-DTLS exploitation requires an on-path position, DNS spoofing, or winning a race with a forged source address. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit was referenced, so this is 'no public exploit identified at time of analysis' - the signals do not point to active or widespread exploitation. The most important nuance, which raw CVSS obscures, is that impact is strongly SoC- and configuration-dependent: the primitive is a read at address zero, so it only produces a crash on targets where the low address range is unmapped or protected (MMU-based architectures, CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP builds, TrustZone non-secure images, SoCs like nRF54L); on classic Cortex-M parts with a readable vector table at address zero the read typically succeeds harmlessly and the request is rejected by a later length check. There is no confidentiality or integrity impact (C:N/I:N confirmed and matching the description's 'no write, no info-disclosure' analysis). Net: treat as a medium-priority DoS to patch on affected embedded fleets that use the UpdateHub FOTA client without DTLS, rather than an emergency.

A device running Zephyr's UpdateHub FOTA client with the default CONFIG_UPDATEHUB_DTLS unset periodically polls its update server over plain CoAP/UDP on port 5683 with no peer authentication. An on-path attacker, DNS spoofer, or off-path attacker who wins the race with a forged source address replies to the probe with a malformed metadata payload such as '"objects":[[{}],[{}]]' that omits the sha256sum field, causing a NULL-pointer read in z_impl_updatehub_probe(). On SoCs where address zero is unmapped the load faults and Zephyr's fatal handler halts the system, re-triggerable on every poll; no public exploit code was referenced in the input.