Which versions of lwIP are affected by EUVD-2026-30793?

lwIP network stack versions 2.1.0-2.2.1 are vulnerable to remote unauthenticated code execution in their SNMP management interface, with publicly available exploit code already circulating.. A patch is available.

How to fix or mitigate EUVD-2026-30793?

Within 24 hours, inventory all systems running lwIP 2.1.0-2.2.1 and confirm which have SNMP enabled with network accessibility; this establishes immediate risk scope. Within 7 days, apply the available vendor patch from lwIP to all affected production systems, prioritizing assets in critical roles or with external network exposure. Within 30 days, complete remediation across all inventory and validate successful patching; for systems unable to patch immediately, disable SNMP service or restrict SNMP access to isolated management networks through network segmentation.

lwIP EUVD-2026-30793

Q: What is the CVSS score of EUVD-2026-30793?

EUVD-2026-30793 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-8836 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-18 VulDB

GHSA-3w8m-3w76-f6mh

Buffer Overflow Stack Overflow N A Lwip

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Overflow triggered during pre-authentication parsing so no privileges required; unchecked network input into a stack buffer yields full system compromise with no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 22, 2026 - 09:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 22, 2026 - 09:22 vuln.today

cvss_changed

Severity Changed

Aug 22, 2026 - 09:22 NVD

CRITICAL HIGH

CVSS changed

Aug 22, 2026 - 09:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

Source Code Evidence Fetched

May 18, 2026 - 19:30 vuln.today

Analysis Generated

May 18, 2026 - 19:30 vuln.today

CVSS changed

May 18, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.

AnalysisAI

Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through 2.2.1 to remote unauthenticated code execution. The flaw in snmp_parse_inbound_frame() allowed an attacker-controlled msgAuthenticationParameters TLV length to be used directly in a stack buffer copy without bounds validation - a protective assertion had been explicitly commented out in the codebase. With CVSS 4.0 scoring 8.9, SSVC classifying the attack as automatable with total technical impact, and proof-of-concept code in existence (E:P), this is a high-priority remediation target for any network-accessible lwIP deployment with SNMPv3 enabled; no CISA KEV listing has occurred at time of analysis.

Technical ContextAI

lwIP is an open-source, resource-constrained TCP/IP stack widely embedded in RTOS environments such as FreeRTOS and Zephyr, maintained under the GNU Savannah project. The vulnerable code resides in src/apps/snmp/snmp_msg.c within snmp_parse_inbound_frame(), which processes incoming SNMPv3 User-based Security Model (USM) authentication frames. CWE-121 (Stack-based Buffer Overflow) identifies the root cause: the TLV field length tlv.value_len, supplied by the remote peer in the msgAuthenticationParameters field, was used as the copy length into a fixed-size stack buffer without first being bounded to SNMP_V3_MAX_AUTH_PARAM_LENGTH. The patch commit 0c957ec reveals that a protective assertion (IF_PARSE_ASSERT) had been commented out and the copy used the unconstrained attacker-supplied value; the fix re-enables the assertion and replaces tlv.value_len with the constant maximum in the copy call. Affected CPE: cpe:2.3:a:n/a:lwip:*:*:*:*:*:*:*:*, spanning versions 2.1.0 through 2.2.1.

RemediationAI

Apply upstream patch commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c, available at https://github.com/lwip-tcpip/lwip/commit/0c957ec03054eb6c8205e9c9d1d05d90ada3898c and https://cgit.git.savannah.gnu.org/cgit/lwip.git/commit/?id=0c957ec03054eb6c8205e9c9d1d05d90ada3898c. No specific patched release version number has been independently confirmed - the fix exists as a commit to the upstream repository only; downstream device vendors must integrate it and issue updated firmware, making direct patch application unavailable for most end users. Ubuntu users should apply the package update per USN-8423-1. Where immediate patching is not feasible, disable SNMP and SNMPv3 at compile time by omitting LWIP_SNMP and SNMP_V3 build flags, which eliminates the entire attack surface but removes SNMP-based management capability. As a network-level compensating control, restrict inbound UDP port 161 access to trusted management hosts using firewall ACLs; this does not prevent exploitation from within the allowed segment but significantly reduces external exposure. If SNMPv3 is not operationally required, downgrading to SNMPv1 or SNMPv2c bypasses the vulnerable USM code path, trading the USM vulnerability for the weaker security properties of those protocol versions.