arduino-esp32 EUVD-2026-25619

NetBIOS functionality must be explicitly enabled in the application code via NBNS.begin() method call-this is not enabled by default in arduino-esp32. Attacker must have adjacent network access (AV:A from CVSS vector), meaning they must be on the same Layer 2 broadcast domain or VLAN as the target ESP32 device to send UDP packets to port 137. No authentication or user interaction is required once these prerequisites are met. Exploitation is limited to devices actually using the NBNS feature for Windows network integration or name resolution, which represents a subset of total arduino-esp32 deployments. Devices using only Wi-Fi client mode without NetBIOS, or those deployed in isolated networks without adjacent attacker access, are not exploitable despite running vulnerable code versions.

This represents a high-severity risk for deployments that have explicitly enabled NetBIOS functionality, though real-world exploitation probability is moderate due to several limiting factors. The CVSS score of 8.8 accurately reflects the technical severity with adjacent network attack vector (AV:A), low complexity (AC:L), no authentication (PR:N), and high impact across confidentiality, integrity, and availability. However, exploitation requires the attacker to be on the same local network segment as the vulnerable device and NetBIOS must be explicitly enabled through NBNS.begin() calls in the application code-this is not a default configuration. No CISA KEV listing suggests this is not being exploited at scale in the wild, and EPSS data is unavailable to assess broader exploitation probability. The adjacent network requirement significantly reduces attack surface compared to internet-exposed vulnerabilities, but in compromised networks or malicious insider scenarios, exploitation is straightforward given the low complexity and lack of authentication. For industrial IoT deployments or building automation systems using ESP32 devices with NetBIOS enabled for Windows network integration, this should be prioritized for patching. For typical consumer IoT devices that don't use NBNS, the risk is theoretical.

An attacker connected to the same local network as an ESP32 device running arduino-esp32 with NetBIOS enabled crafts a malicious NBNS query packet with an oversized name_len field. Sending this packet to UDP port 137 triggers a stack-based buffer overflow in the NBNS parser, overwriting return addresses or function pointers to redirect execution to attacker-controlled shellcode embedded in the packet payload. The attacker gains arbitrary code execution with full device privileges, potentially using the compromised microcontroller as a pivot point for lateral movement within the operational technology network or to manipulate connected sensors and actuators.