Lwip
Monthly
Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through 2.2.1 to remote unauthenticated code execution. The flaw in snmp_parse_inbound_frame() allowed an attacker-controlled msgAuthenticationParameters TLV length to be used directly in a stack buffer copy without bounds validation - a protective assertion had been explicitly commented out in the codebase. With CVSS 4.0 scoring 8.9, SSVC classifying the attack as automatable with total technical impact, and proof-of-concept code in existence (E:P), this is a high-priority remediation target for any network-accessible lwIP deployment with SNMPv3 enabled; no CISA KEV listing has occurred at time of analysis.
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Stack-based buffer overflow in lwIP's SNMPv3 USM handler exposes embedded and IoT devices running versions 2.1.0 through 2.2.1 to remote unauthenticated code execution. The flaw in snmp_parse_inbound_frame() allowed an attacker-controlled msgAuthenticationParameters TLV length to be used directly in a stack buffer copy without bounds validation - a protective assertion had been explicitly commented out in the codebase. With CVSS 4.0 scoring 8.9, SSVC classifying the attack as automatable with total technical impact, and proof-of-concept code in existence (E:P), this is a high-priority remediation target for any network-accessible lwIP deployment with SNMPv3 enabled; no CISA KEV listing has occurred at time of analysis.
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.