Lwip Api
Monthly
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.
Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.