CVE-2021-3320

CVE-2021-3320 affects Zephyr RTOS: Type Confusion in 802154 ACK frame handling, with Zephyr versions >= 2.4.0 exhibiting a NULL Pointer Dereference (CWE-476). The NVD entry links to GHSA-27r3-rxch-2hm7 for advisory details. Impact is described as a NULL pointer dereference, which can lead to a...

CVE-2017-14201

The CVE-2017-14201 entry describes a Use After Free vulnerability in the Zephyr shell that can be triggered by a serial or telnet connected user, leading to denial of service and potentially remote code execution. Affected are Zephyr shell versions prior to 1.14.0 on all platforms. No explicit re...

CVE-2017-14202

CVE-2017-14202 in Zephyr concerns the shell component where an improper restriction of operations within the bounds of a memory buffer can be triggered by a serial or telnet connection, causing a crash and potentially arbitrary code execution. Affected: Zephyr shell versions prior to 1.14.0 on al...

CVE-2026-5067

The CVE targets Zephyr’s HTTP server WebSocket upgrade path (CONFIG_HTTP_SERVER_WEBSOCKET enabled). A crafted Sec-WebSocket-Key header can trigger memory corruption via a non-NUL-terminated copy into a fixed-size buffer, followed by copying to a local stack buffer and using strlen(). If no NUL ex...

CVE-2026-20435

CVE-2026-20435 concerns a logic error in the preloader of MediaTek-based devices that allows reading device unique identifiers. The vulnerability can enable local information disclosure with physical access and no required user interaction or execution privileges. Affected component: preloader; u...

CVE-2020-10063

CVE-2020-10063 concerns Zephyr RTOS. Multiple connected sources confirm a vulnerability in Zephyr where an input validation error in CoAP packet handling can allow a remote attacker to cause a denial of service. Affected product/version: Zephyr (zephyrproject-rtos) version 2.2.0 and later. The CN...

CVE-2023-4258

CVE-2023-4258 affects Zephyr RTOS Bluetooth mesh provisioning: an insecure handling in the provisionee’s provisioning protocol allows an OOB public key, if provided, to be echoed back and accepted during provisioning. This description comes from multiple sources noting that the OOB key can be sen...

CVE-2020-10062

The vulnerability CVE-2020-10062 affects Zephyr RTOS MQTT packet length decoder (off-by-one) in Zephyr 2.2.0 and later. Root cause: off-by-one in the decoder leading to memory corruption and possible remote code execution. Impact: memory corruption with potential code execution. Remediation: fixe...

CVE-2020-10071

Zephyr CVE-2020-10071 affects Zephyr RTOS 2.2.0 and later. The MQTT parsing code fails to adequately validate the length field on publish messages, enabling a buffer overflow that could lead to remote code execution. Multiple sources describe this as a buffer-overflow vulnerability due to insuffi...

CVE-2020-10061

CVE-2020-10061 describes a vulnerability in the Zephyr Bluetooth implementation where improper handling of the full-buffer case can lead to memory corruption. Affected products are Zephyr RTOS with Bluetooth, specifically versions 2.2.0 and later, and 1.14.0 and later. Reported by multiple source...

CVE-2020-10070

No technical details are publicly available in the provided documents for CVE-2020-10070. Monitor for updates.

CVE-2023-4263

CVE-2023-4263 affects Zephyr RTOS, specifically the IEEE 802.15.4 nRF 15.4 driver (ieee802154_nrf5.c). The connected Red Hat and Veracode entries corroborate a buffer overflow vulnerability in this driver, with Zephyr’s nRF5 driver cited as the vulnerable component. Exploitation status is not pro...

CVE-2021-3454

CVE-2021-3454 concerns Zephyr RTOS, where a truncated L2CAP K-frame causes an assertion failure. Multiple connected sources corroborate that Zephyr versions 2.4.0 and later are affected, due to improper handling of length parameter inconsistencies (CWE-130) and a reachable assertion (CWE-617). Av...

CVE-2023-4257

CVE-2023-4257 affects Zephyr RTOS, specifically the wifi shell module located at /subsys/net/l2/wifi/wifi_shell.c. The root cause is an unchecked user input length in the wifi shell parsing path (notably __wifi_args_to_params), which can lead to a buffer overflow. Documented impacts include memor...

CVE-2024-1638

CVE-2024-1638 concerns Bluetooth LE GATT permission checks in Zephyr and related disclosures. The issue is that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC flags are intended to require LE Secure Connections for read/write access, but only when used with additional permissions (BT_GATT...

CVE-2020-10068

The CVE-2020-10068 entry describes a denial-of-service vulnerability in the Zephyr project Bluetooth subsystem caused by an input validation error. Affected software is Zephyr RTOS versions 2.2.0 and later, and 1.14.0 and later. The vulnerability stems from handling of certain duplicate/back-to-b...

CVE-2023-1901

The CVE concerns Zephyr's Bluetooth HCI host layer. The issue arises from not clearing a global reference to a semaphore after synchronously sending HCI commands, which may allow a malicious HCI Controller to reuse a dangling reference in the host layer. Reported impacts include DoS via a crash a...

CVE-2023-4259

CVE-2023-4259 describes two potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver. Connected sources attribute the flaws to the eS-WiFi core handling in eswifi_core.c and eswifi_shell.c, caused by inadequate input validation. Zephyr versions affected include 3.4.0 and earlier. No...

CVE-2021-3455

This CVE affects Zephyr RTOS (2.4.0+ and 2.5.0+). The issue is a resource management error triggered by disconnecting the L2CAP channel immediately after an invalid ATT request, which can cause a freeze. Per NVD, affected versions exhibit a Use-After-Free (CWE-416). Documentation cites the GHSA a...

CVE-2025-1673

CVE-2025-1673 affects Zephyr RTOS with a vulnerability in DNS packet handling. Multiple connected sources describe an out-of-bounds read triggered by a malicious or malformed DNS packet without a payload, potentially causing a crash (DoS) or incorrect computation. The CVE entry references an issu...

CVE-2024-3332

CVE-2024-3332 describes a vulnerability where a malicious Bluetooth Low Energy device can trigger a specific packet sequence that leads to a denial-of-service (DoS) on the victim BLE device. Multiple sources tie this to a null pointer dereference in Zephyr OS components (notably libzephyr.so) and...

CVE-2021-3431

CVE-2021-3431 concerns Zephyr RTOS. Affected: Zephyr versions >= 2.5.0 where repeated LL_FEATURE_REQ can trigger a Reachable Assertion (CWE-617). Documented impact across sources describes a denial of service risk arising from this assertion. Root cause identified as the repeated LL_FEATURE_RE...

CVE-2025-1675

CVE-2025-1675 stems from a bounds-check failure in the function dns_copy_qname within dns_pack.c, where a memcpy uses an untrusted source and the code does not verify that the source buffer is large enough to contain the copied data. Multiple sources (NVD, Red Hat, CVE lists, and Zephyr-related d...

CVE-2025-1674

CVE-2025-1674 is a vulnerability in Zephyr RTOS (Zephyr project) arising from insufficient input validation that allows out-of-bounds reads when processing malicious or malformed packets. Public details from multiple sources indicate the issue affects Zephyr up to version 4.0 and earlier. The nat...

CVE-2020-10027

Technical details about CVE-2020-10027 are not publicly available in the provided connected documents; monitor for updates.

CVE-2020-13603

CVE-2020-13603 affects Zephyr Project RTOS: memory-allocation integer overflow in Zephyr’s allocator. Affected versions: Zephyr 1.14.2 and newer (including 2.4.0 and beyond). Root cause is an integer overflow/wraparound in memory allocating functions, leading to potential memory corruption. Publi...

CVE-2020-10059

CVE-2020-10059 affects Zephyr Project RTOS (2.1.0 and later) via the UpdateHub module, which disables DTLS peer checking. This enables a man-in-the-middle risk, mitigated by firmware signatures, with no shown exploit details in the documents. The issue sits with the UpdateHub component and is lin...

CVE-2021-3625

CVE-2021-3625 concerns a heap-based buffer overflow (CWE-122) in Zephyr’s USB DFU DNLOAD path. Affected product: Zephyr RTOS; vulnerable component is the USB DFU DNLOAD code, with root cause described as a heap-based overflow. Impact details in sources indicate a potential for memory data leakage...

CVE-2021-3433

Zephyr RTOS: A vulnerability in CONNECT_IND from an invalid channel map in versions >= v2.5.0 can cause a deadlock due to improper handling of exceptional conditions (CWE-703). Affected component is the CONNECT_IND channel mapping; impact is partial availability. The primary public advisory is...

CVE-2022-2741

CVE-2022-2741 affects Zephyr (CAN networking). A DoS can be triggered by sending a specially crafted CAN frame on the same CAN network, where the frame’s CAN ID matches an installed filter on the vulnerable node and the frame’s RTR bit is the opposite of what the filter expects. The vulnerability...

CVE-2022-2993

CVE-2022-2993 affects Zephyr RTOS (3.1 and earlier). The issue is an error in the condition of the last if-statement in the function smp_check_keys, causing rejection of current keys when all requirements are unmet. Public sources describe it as a design/logic flaw in key validation, with potenti...

CVE-2024-6258

CVE-2024-6258 relates to Zephyr RTOS, where the RFCOMM data handling function rfcomm_handle_data lacks proper net_buf length checks, enabling a heap-based buffer overflow. Connected sources indicate Zephyr versions 3.6 and earlier are affected, with potential memory corruption or DoS as the outco...

CVE-2020-10060

CVE-2020-10060 affects Zephyr’s UpdateHub module. The vulnerability arises in updatehub_probe: after JSON parsing, the code accesses objects[1], which can reference uninitialized stack memory if the JSON has fewer than two elements. This could crash the process, cause a denial of service, or pote...

CVE-2020-10021

CVE-2020-10021 is an active vulnerability describing an out-of-bounds write in the USB Mass Storage memoryWrite handler caused by unaligned sizes. Affected: Zephyr RTOS, Zephyr 1.14.1 and later, and 2.1.0 and later. CVSS data indicate a high-severity, local-attack scenario with potential confiden...

CVE-2020-10024

This CVE concerns Zephyr RTOS: the ARM platform-specific code uses a signed integer comparison when validating syscall numbers. The root cause enables privilege escalation from a user thread to kernel level if code execution is obtained in user space. Affected versions are Zephyr project-rtos Zep...

CVE-2021-3434

CVE-2021-3434 affects Zephyr RTOS; a stack-based buffer overflow in the le_ecred_conn_req() function is present in Zephyr versions >= 2.5.0 (CWE-121). The vulnerability is localized (LOCAL, low attack complexity) with potentially high impact to confidentiality, integrity, and availability as d...

CVE-2023-0779

Technical details for CVE-2023-0779 are not publicly available in the provided documents; monitor for updates.

CVE-2026-5066

The CVE-2026-5066 issue affects Zephyr’s network sockets TLS path (subsys/net/lib/sockets/sockets_tls.c). When TLS session caching is enabled, tls_session_store() and tls_session_restore() memcpy a caller-supplied address using addrlen without validating against the destination size, allowing an ...

CVE-2020-10019

CVE-2020-10019 describes a buffer overflow in Zephyr’s USB DFU path. The flaw occurs when the requested length (wLength) is not validated against the destination buffer size, enabling exploitation by a USB host. Affected products are Zephyr RTOS releases 1.14.1 and later, and 2.1.0 and later. The...

CVE-2020-10067

CVE-2020-10067 affects Zephyr Project RTOS. A malicious userspace application can trigger an integer overflow that bypasses security checks in system call handlers, with impacts ranging from denial of service to information leak and memory corruption potentially enabling kernel code execution. Af...

CVE-2021-3835

CVE-2021-3835 affects Zephyr RTOS USB device class: a heap-based buffer overflow (CWE-122) in versions >= v2.6.0. Impact per sources includes high/partial confidentiality, integrity, and availability risks (per CVSS 3.1 data). Advisory GHSA-fm6v-8625-99jf referenced for details. No patch/versi...

CVE-2023-5184

CVE-2023-5184 affects Zephyr IPM drivers in Zephyr RTOS. Root cause: signed-to-unsigned conversion errors and a buffer overflow in IPM send paths, notably in ipm_imx.c and ipm_mcux.c, with a related size validation path in ipm_cavs_host.c. Impact: potential buffer overflow leading to memory corru...

CVE-2024-5931

CVE-2024-5931 affects Zephyr RTOS, specifically the bap_broadcast_assistant component, due to unchecked user input. Public sources indicate affected version range includes Zephyr 3.6 and earlier; the underlying issue is improper input validation, with potential availability impact (per NVD CVSS: ...

CVE-2023-0396

CVE-2023-0396 describes a buffer overread in the Bluetooth controller’s handling of HCI command responses. The root cause is a malformed/defective Bluetooth controller causing overreads across many functions that process HCI responses. Documents consistently reference high impact on confidentiali...

CVE-2021-3430

CVE-2021-3430 affects Zephyr RTOS v1.14 and later, where an assertion can be reached via a repeated LL_CONNECTION_PARAM_REQ. The CVE describes a Reachable Assertion (CWE-617) that could enable a denial-of-service condition. Public documentation in NVD and CNVD notes this vulnerability and referen...

CVE-2023-0359

CVE-2023-0359 concerns Zephyr RTOS: a missing nullptr-check in the handle_ra_input function can lead to a NULL dereference. The public description states this is the core issue; CVSS metrics from NVD indicate a base score of 7.5 (HIGH) with network attack vector and no user interaction, and the i...

CVE-2020-10058

CVE-2020-10058 affects Zephyr Project RTOS (Kscan subsystem). The issue arises from insufficient parameter validation in multiple Kscan syscalls, enabling a local user to potentially gain elevated privileges. Publicly documented details from CNVD-2020-35003 confirm Zephyr 2.1.0 and later are affe...

CVE-2021-3432

CVE-2021-3432 affects Zephyr RTOS where an invalid interval in CONNECT_IND can trigger a division by zero (CWE-369). The NVD entry states Zephyr versions >= 1.14.0 are vulnerable, with an impact described as availability loss, and references GHSA-7364-p4wc-8mj4 for more information. The vulner...

CVE-2022-1042

CVE-2022-1042 : The Zephyr Bluetooth Mesh core stack contains an out-of-bounds write vulnerability that can be triggered during provisioning. The connected documents confirm the affected software as Zephyr’s Bluetooth mesh core stack and identify the root cause as an out-of-bounds write, with hig...

CVE-2023-7060

CVE-2023-7060 affects Zephyr OS IP packet handling. The issue can cause external-interface IP packets with a source address of 127.0.01 (or destination address) to not be properly dropped, potentially impacting availability. Affected component: Zephyr OS networking/IP filtering; root cause: impro...