Zephyr RTOS EUVD-2026-43245

Physical or directly adjacent USB bus control is required - the attacker must be able to drive the USB bus as a USB host connected to the vulnerable device. The target device must be running Zephyr RTOS v4.4.0 compiled with CONFIG_UDC_NUMAKER enabled and devicetree support for the Nuvoton NuMaker HSUSBD controller (DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED). No authentication, credentials, or software-level privileges on the device are required; the exploit operates purely at the USB protocol layer by issuing valid (if hostile) SETUP and cancel sequences. Exploitation is limited to: (1) physical proximity to a device's USB port, (2) a specific Nuvoton hardware platform, (3) Zephyr v4.4.0 specifically. The impact is reversible - a USB reset or device re-plug fully restores normal operation, limiting the attack to a temporary denial of service.

Real-world risk is very low. The CVSS base score of 2.4 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the threat model: exploitation requires physical or adjacently-controlled USB bus access - the attacker must be able to drive the USB bus directly. The impact is strictly availability, limited to the device's USB function, and is fully recoverable with a USB reset or physical re-plug, meaning there is no persistent damage. No EPSS data was provided and the vulnerability is not listed in CISA's KEV catalog. No public proof-of-concept exploit code has been identified. The SSVC technical impact is partial (USB function loss only), exploitation is not automatable at scale (requires physical bus control), and affected deployment is narrowly scoped to embedded systems using a specific Nuvoton HSUSBD controller running Zephyr v4.4.0. The combination of physical attack vector, availability-only DoS, reversibility of impact, and narrow hardware specificity places this firmly in a low-priority remediation tier for most organizations, relevant primarily to product security teams shipping devices on Nuvoton NuMaker hardware.

An attacker with physical access to a device's USB port connects a malicious or scripted USB host (such as a Facedancer or similar USB exploitation tool) that deliberately times out control transfers and rapidly re-issues SETUP packets. After a small number of cancel-and-re-SETUP cycles, the HSUSBD hardware and driver state become permanently desynchronized, causing the control endpoint to NAK all subsequent control transfers. The device's USB function stops enumerating, effectively taking the USB interface offline until the device is physically unplugged and re-plugged or a USB reset is issued.