Zephyr RTOS EUVD-2026-29387

SPECIFIC CONDITION: The net ping shell command must be available and accessible on the target Zephyr RTOS device (requires Zephyr network shell module enabled and shell interface accessible). The attacker must be able to interact with the shell locally (local access via UART, serial console, or local user account). The target address must be a local IPv4 address assigned to the device itself. No special network configuration or non-default settings are required beyond shell enablement. The attack requires UI:R (user interaction) - the attacker must manually execute the ping command; automatic exploitation is not possible. Headless deployments without shell access, systems with ICMP disabled, or restricted shell permissions prevent this attack.

CVSS score of 6.1 (Medium) reflects the local attack vector (AV:L) and non-default user interaction requirement (UI:R), which significantly limits real-world exploitation scope compared to network-accessible vulnerabilities. However, EPSS score and KEV status are not provided, preventing assessment of actual exploitation prevalence. The primary impact is availability (A:H - high) via denial of service through stack exhaustion; confidentiality and integrity impacts are nil (C:N/I:L per vector). Risk is elevated for production embedded systems and IoT deployments running Zephyr where the network shell is enabled or accessible to local users, but substantially lower for headless deployments without shell access. The AC:L (low complexity) indicates no special exploitation preconditions beyond executing a single command. MISSING DATA: Exploitation status (KEV or POC availability) and patch availability from vendor advisory prevent full exploitation-readiness assessment.

An attacker with local access to a Zephyr RTOS device executes the shell command net ping <device-local-ipv4-address> (e.g., net ping 192.168.1.10 where 192.168.1.10 is the device's own address). The ICMP echo request is processed inline, triggers generation of an echo reply, and recursive re-entry on the same work-queue stack exhausts available memory. The device's network stack crashes or the system reboots due to stack overflow, resulting in denial of service.