CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...

CVE-2026-86086

CVE-2026-86086 Zephyr Project: under embargo until 2026-12-01...

vulns

vulnerability reports HN Security's advisories. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Multiple vulnerabilities in Solaris dtprintinfo and libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Multiple vulnerabilities in Zyxel zysh...

signy

signy Signed URLs for small devices. Background signy is a library for generating signed URLs on embedded devices using asymmetric cryptography. Signed URLs are typically utilized to grant time-limited access to private resources, such as those served by a Content Delivery Network CDN. In the...

zephyr_cve-2021-3625

CVE-2021-3625 This repository contains a few example exploits for CVE-2021-3625. All Zephyr-based usb devices up to and including version 2.5.0 suffer from a buffer overflow allowing readout of up to 65kB. Depending on the actual device this may result of leakage of sensitive data like encryption...

CVE-2026-16664

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16659

MCUboot's serial-recovery image-upload handler bsupload in boot/bootserial/src/bootserial.c declares const struct flasharea fap = NULL and assigns it only via flashareaopen part-way through the function. Two early validation failures goto outinvaliddata — a CBOR map that fails to decode, or an...

CVE-2026-16664 Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

EUVD-2026-124790

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16664 Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16664

The MCUboot bootloader's Zephyr port contains an out-of-bounds read (CWE-192) in the bs_upload() handler within boot/boot_serial/src/boot_serial.c. The vulnerability occurs because the host-supplied img_num from an MCUmgr image-upload request is processed without a range check before being used t...

PT-2026-146113

MCUboot's Zephyr serial-recovery upload handler bs upload in boot/boot serial/src/boot serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img num a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes img num straight t...

PT-2026-146111

MCUboot's serial-recovery image-upload handler bs upload in boot/boot serial/src/boot serial.c declares const struct flash area fap = NULL and assigns it only via flash area open part-way through the function. Two early validation failures goto out invalid data — a CBOR map that fails to decode, ...

CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

CVE-2026-126957 ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

CVE-2026-126957

An integer underflow in Zephyr 's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When responding to an ICMP Echo Request containing an IPv4 Record Route or Timestamp option, the functions icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/n...

EUVD-2026-124154

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

CVE-2026-126957 ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4updaterecordroute and icmpv4updatetimestamp in subsys/net/ip/icmpv4.c compute th...

PT-2026-145667

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4 update record route and icmpv4 update time stamp in subsys/net/ip/icmpv4.c...