CVE-2026-11812

CVE-2026-11812 concerns the UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) where access to a single file-scope ctx structure is not serialized. The code allows two concurrent flows to mutate ctx (background autohandler and user-triggered operations), and prepare_fds() can writ...

CVE-2026-11811

The CVE-2026-11811 entry documents a socket-file-descriptor leak in the UpdateHub OTA client (start_coap_client) when connection-setup fails. The leak occurs because on failure paths the cleanup gate does not call cleanup_connection(), leaving an open descriptor in the global ctx.sock that is ove...

CVE-2026-11809

CVE-2026-11809 (Zephyr UpdateHub OTA client) : The UpdateHub probe in subsys/mgmt/updatehub/updatehub.c uses a second heap buffer (metadata_copy) via memcpy(metadata_copy, metadata, strlen(metadata)) without zeroing. This omits the terminating NUL, so a subsequent json_obj_parse(metadata_copy, st...

CVE-2026-11810

CVE-2026-11810 affects Zephyr’s UpdateHub firmware-update agent. The probe handler z_impl_updatehub_probe() parses CoAP-provided JSON metadata into a two-level nested array; it only validates the outer array length and then dereferences objects[1].objects[0].objects.sha256sum with strlen() withou...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

EUVD-2020-2487

Malware in sbrugna...

EUVD-2020-2524

Malware in sbrugna...

Zephyr Trust Management Issues Vulnerabilities

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A trust management issue vulnerability exists in the UpdateHub module in Zephyr 2.1.0 and later fixed in version 2.2.0, which stems from the program disabling DTLS peer checking. An attacker could use...

Zephyr Code Execution Vulnerability

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A security vulnerability exists in Zephyr versions 2.1.0 and later and 2.2.0 and later. An attacker can exploit this vulnerability by sending a malformed JSON file to the UpdateHub server to cause a...

CVE-2020-10060

In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...

CVE-2020-10059

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-10059

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-10022

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...

Memory corruption

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...

Code injection

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-10059 UpdateHub Module Explicitly Disables TLS Verification

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-10059

CVE-2020-10059 affects Zephyr Project RTOS (2.1.0 and later) via the UpdateHub module, which disables DTLS peer checking. This enables a man-in-the-middle risk, mitigated by firmware signatures, with no shown exploit details in the documents. The issue sits with the UpdateHub component and is lin...

CVE-2020-10060 UpdateHub Might Dereference An Uninitialized Pointer

In updatehubprobe, right after JSON parsing is complete, objects\1 is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an...

CVE-2020-10022

CVE-2020-10022 affects Zephyr OS (zephyrproject-rtos) via a malformed JSON payload received from an UpdateHub server, causing memory corruption. This leads to either denial of service or potential code execution in Zephyr versions 2.1.0 and later (including 2.2.0+). Root cause described across co...

CVE-2020-10022 UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later...