Zephyr UpdateHub EUVD-2026-55805

Exploitation requires the attacker to control or spoof the JSON metadata returned by the UpdateHub server that the target device is configured to contact. Two concrete paths exist: (1) direct compromise of the UpdateHub OTA server, which is a trusted infrastructure component; or (2) a network man-in-the-middle attack on the CoAP session - this second path is only viable when DTLS is not enabled for the CoAP transport, as DTLS would authenticate the server and encrypt the channel. The vulnerable code is reached only when the device performs an OTA probe (z_impl_updatehub_probe()), not continuously. No authentication is required from the attacker with respect to the Zephyr device itself, as the device initiates the outbound request. The UpdateHub subsystem must be compiled and enabled in the firmware image; devices not using UpdateHub are not affected. Affected version range is Zephyr 3.7.0 through 4.4.1.

The vendor CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the worst-case reachability and the high availability impact but overstates ease of exploitation by assigning AC:L. Reliable exploitation requires either compromise of the configured UpdateHub server - a trusted OTA infrastructure endpoint - or an active network MITM position on the CoAP channel, which is only viable when DTLS is disabled; neither is trivially achievable from the open internet, and AC:H is a more accurate assessment of that prerequisite. EPSS data was not included in the provided intelligence, so probability-of-exploitation estimates cannot be compared. KEV status is not listed, no public proof-of-concept is identified, and the Zephyr Project has not indicated observed exploitation, all of which support treating this as an unconfirmed-exploitation vulnerability today. The impact on embedded and IoT fleets is nonetheless operationally significant: a DoS that halts update probes can prevent downstream security patching and, in watchdog-free configurations, may require physical intervention to recover devices. The 'Information Disclosure' tag in the source metadata is not supported by the description, which explicitly states no confidentiality or integrity impact; that tag should be disregarded. Overall this is a real, technically straightforward flaw for any attacker with server-level or network-path access, but the required position limits its attractiveness for opportunistic mass exploitation.

An attacker who has compromised the configured UpdateHub OTA server, or who occupies a MITM position on a network segment where DTLS is not enforced, waits for an affected Zephyr device to perform a routine firmware probe. The attacker returns a crafted JSON metadata response in which the outer objects array has two entries but the inner array of the second entry is empty; when the device calls strlen() on the resulting NULL sha256sum pointer, a fatal CPU fault fires and the device halts or resets. No public proof-of-concept has been identified, but the fix commit exposes the exact code path, making reproduction straightforward for a researcher with access to a Zephyr build environment.