47 matches found
zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri
CVE-2026-10672 — Zephyr LwM2M 펌웨어 업데이트 OOB 읽기 PoC CVE-2026-10672 에 대한 개념 증명PoC으로, Zephyr RTOS의 LwM2M 펌웨어 업데이트 풀 클라이언트subsys/net/lib/lwm2m/lwm2mpullcontext.c에서 발생하는 범위를 벗어난 읽기out-of-bounds read입니다. 취약점 CVE : CVE-2026-10672 CVSS : 8.2 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CWE : CWE-125 ...
CVE-2026-18746
parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...
CVE-2026-18746: NULL Pointer Dereference
parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...
CVE-2026-18746
The Zephyr LwM2M client is vulnerable to a NULL pointer dereference in the parse_write_op() function within subsys/net/lib/lwm2m/lwm2m_message_handling.c. When the static CoAP Block1 context pool (defaulting to 3 entries) is exhausted, the init_block_ctx() function returns -ENOMEM and sets the ca...
CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted
parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...
CVE-2026-14368
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
CVE-2026-14368
CVE-2026-14368 is an off-by-one out-of-bounds write in the Zephyr RTOS LwM2M JSON content formatter. The get_string() function in subsys/net/lib/lwm2m/lwm2m_rw_json.c uses a boundary check of string_length > buflen instead of >=, allowing a parsed JSON string whose length exactly equals the...
CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
EUVD-2026-68723
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
CVE-2026-14368: Out-of-bounds Write
The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
PT-2026-83953
The LwM2M JSON content formatter's get string in subsys/net/lib/lwm2m/lwm2m rw json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if string length buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...
CVE-2026-5855
Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...
PT-2026-68757
Name of the Vulnerable Software and Affected Versions Contiki-NG affected versions not specified Description The LwM2M TLV parser lwm2m tlv read in os/services/lwm2m/lwm2m-tlv.c fails to validate the caller-supplied buffer length, reading up to six bytes from the input buffer without bounds...
CVE-2026-10672
CVE-2026-10672 affects Zephyr LwM2M firmware Update pull: a memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN) into a 128-byte buffer, with no length validation, copies up to 128 bytes of a server URI and omits the NUL terminator. Subsequent strlen and CoAP/PROXY_URI parsing read past the end into a...
EUVD-2019-18391
Malware in sbrugna...
EUVD-2020-5847
Malware in sbrugna...