Buffer Overflow in Zephyr RTOS LwM2M Firmware Update

Executive Summary

CVE-2026-10672 is a vulnerability in the Zephyr RTOS's LwM2M (Lightweight M2M) firmware update mechanism. The issue occurs in the pull-context handling code where a server-supplied firmware Package URI is copied into a fixed-size static buffer without proper length validation.

The Firmware-Update object stores the URI in a 255-byte buffer, but the pull-context buffer is smaller (default 128 bytes). When a URI longer than the pull-context buffer is provided, only the first 128 bytes are copied without a NUL terminator. This causes subsequent string operations (like strlen) to read past the buffer's end, leading to out-of-bounds memory access.

The vulnerability can result in two main impacts: information disclosure, where adjacent memory is leaked in outbound CoAP requests, and denial of service, where the device may crash due to invalid memory access.

• The vulnerability was introduced in the pull-context refactor and affects versions from v3.0.0 through v4.4.0.
• It requires CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT to be enabled (which is default-on).
• An attacker can exploit this remotely via a malicious LwM2M server or by intercepting an unprotected session.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability on your network or system involves checking for signs of exploitation or verifying the presence of the vulnerable code in your Zephyr RTOS deployment.

• Check Zephyr RTOS version: The vulnerability affects versions v3.0.0 through v4.4.0. Verify your Zephyr version using the build or firmware metadata. For example, if you have access to the build system, check the version in the Zephyr project configuration or firmware headers.
• Inspect LwM2M server communications: Monitor network traffic between your device and the LwM2M server for unusually long Package URI values (128-254 characters). Tools like Wireshark can be used to capture and analyze CoAP traffic. Look for CoAP requests containing the Firmware-Update object (/5/0/1) with a URI longer than 127 bytes.
• Check for CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT: This configuration must be enabled for the vulnerability to be exploitable. Review your Zephyr project's configuration file (e.g., prj.conf or Kconfig) for this setting. If it is enabled, your system may be vulnerable.
• Review device logs for crashes or anomalies: The vulnerability can cause device crashes (denial of service) due to out-of-bounds memory reads. Check device logs for unexpected reboots or errors related to LwM2M firmware updates.
• Static code analysis: If you have access to the Zephyr RTOS source code, inspect the file subsys/net/lib/lwm2m/lwm2m_pull_context.c for the vulnerable memcpy call in the lwm2m_pull_context_start_transfer() function. The absence of a length check before copying the URI is a key indicator.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using a Zephyr RTOS-based device with LwM2M firmware update functionality enabled.

• Denial of Service (DoS): The device may crash or become unresponsive due to out-of-bounds memory reads, disrupting normal operations.
• Information Disclosure: Sensitive data from adjacent memory (such as credentials, keys, or other device state) may be leaked in outbound CoAP requests to the server or proxy.
• Remote Exploitation: An attacker with access to the LwM2M server or an on-path position in an unprotected session can trigger the vulnerability without physical access to the device.

The impact is particularly severe in environments where devices rely on LwM2M for remote management, such as IoT deployments, industrial control systems, or medical devices.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with several standards and regulations, depending on the context in which the affected device is used.

• GDPR (General Data Protection Regulation): If the device processes personal data of EU citizens and the vulnerability leads to unauthorized disclosure of that data, it could violate GDPR's confidentiality and integrity requirements. This may result in fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): In healthcare environments, if the device handles protected health information (PHI) and the vulnerability exposes such data, it could lead to non-compliance with HIPAA's security and privacy rules.
• Industrial and Critical Infrastructure Standards: For devices used in industrial control systems (e.g., IEC 62443), the vulnerability could violate requirements for secure remote management and data integrity, leading to compliance failures.
• General Security Standards: The vulnerability may also conflict with broader security frameworks like ISO 27001, which mandates protection against unauthorized access and data leaks.

Organizations using affected devices should assess whether the vulnerability exposes them to compliance risks and take remediation steps (e.g., patching or disabling the vulnerable feature) to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Zephyr RTOS: Apply the patch by upgrading to Zephyr RTOS version v4.5.0 or later, where the vulnerability has been fixed. The fix includes proper length validation and safer string handling.
• Disable CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT: If upgrading is not immediately possible, disable the vulnerable configuration option in your Zephyr project. This will prevent the vulnerable code path from being executed. Edit your prj.conf or Kconfig file to set CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT=n.
• Restrict LwM2M server access: Limit access to trusted LwM2M servers only. Ensure that only authorized servers can communicate with your devices, reducing the risk of exploitation by malicious servers or on-path attackers.
• Enable DTLS for secure communication: If not already enabled, configure your devices to use DTLS for LwM2M communications. This adds encryption and authentication, making it harder for attackers to exploit the vulnerability.
• Monitor network traffic: Deploy network monitoring tools to detect and block unusually long Package URI values in CoAP requests. This can help prevent exploitation attempts until a permanent fix is applied.
• Apply temporary patches: If you cannot upgrade immediately, consider applying a temporary patch to the vulnerable code. Add a length check before copying the URI in lwm2m_pull_context_start_transfer(), as shown in the fix commit (Resource 2). Replace memcpy with strcpy and ensure the URI is properly terminated.

Useful 0 Not Useful 0