4 matches found
CVE-2026-13479
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
EUVD-2026-66555
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...
CVE-2026-13479
Zephyr RTOS LoRaWAN clock-synchronization service (subsys/lorawan/services/clock_sync.c) contains an out-of-bounds read in clock_sync_package_callback(). When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) downlink, the handler reads a 4-byte time correction and a 1-byte token without verify...
CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...