CVE-2020-10071criticalCWE-120CWE-129

CVE-2020-10071: critical vulnerability in zephyrproject-rtos zephyr

Insufficient publish message length validation in MQTT

Published · Updated

Follow this CVE+ Monitor Zephyr

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 3.4%
In short

A flaw in Zephyr's MQTT message handling fails to properly validate the length of published messages, allowing an attacker to send a specially crafted message that overflows a buffer and potentially execute arbitrary code on the device.

Technical detail

The MQTT parser in Zephyr insufficiently validates the length field of PUBLISH messages (CWE-120 buffer overflow, CWE-129 improper validation), enabling a remote attacker to trigger a stack or heap overflow. Exploitation requires network access to the MQTT interface and can result in arbitrary code execution with system privileges.

Summary generated and translated by AI from the official description.
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
zephyrproject-rtos · zephyr
Related CVEs — zephyrproject-rtos zephyr

In the same product, most dangerous first.

CVE-2020-10070CRITICALMQTT buffer overflow on receive bufferEPSS 2.9%CVE-2020-10062CRITICALPacket length decoding error in MQTTEPSS 2.9%CVE-2020-10022CRITICALUpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size ArrayEPSS 2.3%CVE-2021-3625CRITICALBuffer overflow in Zephyr USB DFU DNLOADEPSS 2.3%CVE-2020-10063MEDIUMRemote Denial of Service in CoAP Option Parsing Due To Integer OverflowEPSS 1.8%CVE-2020-10060HIGHUpdateHub Might Dereference An Uninitialized PointerEPSS 1.6%