Lwip Smtp Client
Monthly
Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.
Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.