Search
Find a vulnerability
Search criteria
8 vulnerabilities by lwIP
CVE-2026-119053 (GCVE-0-2026-119053)
Vulnerability from nvd – Published: 2026-10-29 13:08 – Updated: 2026-10-29 14:01
VLAI
EPSS
VEX
Title
lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()
Summary
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 14:01 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/lwip-tcpip/lwip/commit/e984150… | patch |
| https://github.com/lwip-tcpip/lwip | product |
| https://github.com/lwip-tcpip/lwip/blob/77dcd25a7… | technical-description |
| https://www.vulncheck.com/advisories/lwip-2.0.0-t… | third-party-advisory |
Impacted products
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T14:01:35.973034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:01:51.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://savannah.nongnu.org/projects/lwip/",
"defaultStatus": "unaffected",
"product": "lwIP",
"repo": "https://git.savannah.nongnu.org/git/lwip.git",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Julio Fort (Blaze Information Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Julio Fort (Blaze Information Security)"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf-\u003elen instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:08:53.560Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/e98415014aca66ef0daefded8020763b9279a3b2"
},
{
"tags": [
"product"
],
"url": "https://github.com/lwip-tcpip/lwip"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lwip-tcpip/lwip/blob/77dcd25a72509eb83f72b033d219b1d40cd8eb95/src/apps/snmp/snmp_pbuf_stream.c#L111-L122"
},
{
"name": "VulnCheck Advisory: lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lwip-2.0.0-through-2.2.1-snmp-agent-out-of-bounds-read-via-snmp-pbuf-stream-writeto"
}
],
"title": "lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119053",
"datePublished": "2026-10-29T13:08:53.560Z",
"dateReserved": "2026-10-29T11:51:52.064Z",
"dateUpdated": "2026-10-29T14:01:51.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112062 (GCVE-0-2026-112062)
Vulnerability from nvd – Published: 2026-10-18 12:19 – Updated: 2026-10-19 17:56
VLAI
EPSS
VEX
Title
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
Summary
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:56 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/lwip-mdns-search-resu… | third-party-advisory |
| https://github.com/lwip-tcpip/lwip/commit/ab2f69c… | patch |
| https://github.com/lwip-tcpip/lwip/blob/STABLE-2_… | technical-description |
| https://www.vulncheck.com/advisories/lwip-through… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112062-lwip-… | exploit |
Impacted products
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112062",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:56:07.508494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:56:37.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://savannah.nongnu.org/projects/lwip/",
"defaultStatus": "unaffected",
"product": "lwIP",
"repo": "https://git.savannah.nongnu.org/git/lwip.git",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:36.000Z",
"descriptions": [
{
"lang": "en",
"value": "lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:52.023Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c"
},
{
"name": "VulnCheck Advisory: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler"
}
],
"title": "lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112062",
"datePublished": "2026-10-18T12:19:52.023Z",
"dateReserved": "2026-10-18T12:00:07.926Z",
"dateUpdated": "2026-10-19T17:56:37.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91018 (GCVE-0-2026-91018)
Vulnerability from nvd – Published: 2026-09-22 20:25 – Updated: 2026-09-23 13:05
VLAI
EPSS
VEX
Title
Double Free in lwIP (lightweight IP)
Summary
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:03 UTC
CWE
- CWE-415 - Double free
Assigner
References
Date Public
2026-09-22 17:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:03:21.536853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:05:15.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lwIP API",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Evenchick of Tetrel Security reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-22T17:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "lwIP (Lightweight IP)\u0026nbsp;has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system."
}
],
"value": "lwIP (Lightweight IP)\u00a0has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:25:33.530Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://cgit.git.savannah.gnu.org/cgit/lwip.git"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-02.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u0026nbsp;\u003ca href=\"https://cgit.git.savannah.gnu.org/cgit/lwip.git\"\u003ehttps://cgit.git.savannah.gnu.org/cgit/lwip.git\u003c/a\u003e. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec."
}
],
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u00a0 https://cgit.git.savannah.gnu.org/cgit/lwip.git . The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec."
}
],
"source": {
"advisory": "ICSA-26-265-02",
"discovery": "EXTERNAL"
},
"title": "Double Free in lwIP (lightweight IP)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-91018",
"datePublished": "2026-09-22T20:25:33.530Z",
"dateReserved": "2026-09-14T16:40:45.500Z",
"dateUpdated": "2026-09-23T13:05:15.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87121 (GCVE-0-2026-87121)
Vulnerability from nvd – Published: 2026-09-22 19:48 – Updated: 2026-09-22 20:23
VLAI
EPSS
VEX
Title
Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application
Summary
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 20:23 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| lwIP | TCP/IP Stack MQTT |
Affected:
2.0.1 , ≤ 2.2.1
(custom)
|
Date Public
2026-09-22 17:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T20:23:00.531481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:23:09.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TCP/IP Stack MQTT",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shahriyar Jalayeri of ByteRay Ltd. reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-22T17:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "lwIP\u0026nbsp;TCP/IP Stack MQTT\u0026nbsp;is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device."
}
],
"value": "lwIP\u00a0TCP/IP Stack MQTT\u00a0is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:51:50.077Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://savannah.nongnu.org/projects/lwip"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u0026nbsp;\u003ca href=\"https://savannah.nongnu.org/projects/lwip\"\u003ehttps://savannah.nongnu.org/projects/lwip\u003c/a\u003e. The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1."
}
],
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u00a0 https://savannah.nongnu.org/projects/lwip . The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1."
}
],
"source": {
"advisory": "ICSA-26-265-01",
"discovery": "EXTERNAL"
},
"title": "Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-87121",
"datePublished": "2026-09-22T19:48:25.046Z",
"dateReserved": "2026-09-09T21:28:27.099Z",
"dateUpdated": "2026-09-22T20:23:09.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119053 (GCVE-0-2026-119053)
Vulnerability from cvelistv5 – Published: 2026-10-29 13:08 – Updated: 2026-10-29 14:01
VLAI
EPSS
VEX
Title
lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()
Summary
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 14:01 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/lwip-tcpip/lwip/commit/e984150… | patch |
| https://github.com/lwip-tcpip/lwip | product |
| https://github.com/lwip-tcpip/lwip/blob/77dcd25a7… | technical-description |
| https://www.vulncheck.com/advisories/lwip-2.0.0-t… | third-party-advisory |
Impacted products
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T14:01:35.973034Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:01:51.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://savannah.nongnu.org/projects/lwip/",
"defaultStatus": "unaffected",
"product": "lwIP",
"repo": "https://git.savannah.nongnu.org/git/lwip.git",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Julio Fort (Blaze Information Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Julio Fort (Blaze Information Security)"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf-\u003elen instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:08:53.560Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/e98415014aca66ef0daefded8020763b9279a3b2"
},
{
"tags": [
"product"
],
"url": "https://github.com/lwip-tcpip/lwip"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lwip-tcpip/lwip/blob/77dcd25a72509eb83f72b033d219b1d40cd8eb95/src/apps/snmp/snmp_pbuf_stream.c#L111-L122"
},
{
"name": "VulnCheck Advisory: lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lwip-2.0.0-through-2.2.1-snmp-agent-out-of-bounds-read-via-snmp-pbuf-stream-writeto"
}
],
"title": "lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119053",
"datePublished": "2026-10-29T13:08:53.560Z",
"dateReserved": "2026-10-29T11:51:52.064Z",
"dateUpdated": "2026-10-29T14:01:51.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112062 (GCVE-0-2026-112062)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-19 17:56
VLAI
EPSS
VEX
Title
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
Summary
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:56 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haindpwn/lwip-mdns-search-resu… | third-party-advisory |
| https://github.com/lwip-tcpip/lwip/commit/ab2f69c… | patch |
| https://github.com/lwip-tcpip/lwip/blob/STABLE-2_… | technical-description |
| https://www.vulncheck.com/advisories/lwip-through… | third-party-advisory |
| https://hackmd.io/@haindpwn/cve-2026-112062-lwip-… | exploit |
Impacted products
Date Public
2026-10-17 18:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112062",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:56:07.508494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:56:37.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://savannah.nongnu.org/projects/lwip/",
"defaultStatus": "unaffected",
"product": "lwIP",
"repo": "https://git.savannah.nongnu.org/git/lwip.git",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lwip_project:lwip:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-17T18:49:36.000Z",
"descriptions": [
{
"lang": "en",
"value": "lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:52.023Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c"
},
{
"name": "VulnCheck Advisory: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler"
}
],
"title": "lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112062",
"datePublished": "2026-10-18T12:19:52.023Z",
"dateReserved": "2026-10-18T12:00:07.926Z",
"dateUpdated": "2026-10-19T17:56:37.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91018 (GCVE-0-2026-91018)
Vulnerability from cvelistv5 – Published: 2026-09-22 20:25 – Updated: 2026-09-23 13:05
VLAI
EPSS
VEX
Title
Double Free in lwIP (lightweight IP)
Summary
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:03 UTC
CWE
- CWE-415 - Double free
Assigner
References
Date Public
2026-09-22 17:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:03:21.536853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:05:15.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lwIP API",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Evenchick of Tetrel Security reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-22T17:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "lwIP (Lightweight IP)\u0026nbsp;has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system."
}
],
"value": "lwIP (Lightweight IP)\u00a0has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:25:33.530Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://cgit.git.savannah.gnu.org/cgit/lwip.git"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-02.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u0026nbsp;\u003ca href=\"https://cgit.git.savannah.gnu.org/cgit/lwip.git\"\u003ehttps://cgit.git.savannah.gnu.org/cgit/lwip.git\u003c/a\u003e. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec."
}
],
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u00a0 https://cgit.git.savannah.gnu.org/cgit/lwip.git . The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec."
}
],
"source": {
"advisory": "ICSA-26-265-02",
"discovery": "EXTERNAL"
},
"title": "Double Free in lwIP (lightweight IP)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-91018",
"datePublished": "2026-09-22T20:25:33.530Z",
"dateReserved": "2026-09-14T16:40:45.500Z",
"dateUpdated": "2026-09-23T13:05:15.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87121 (GCVE-0-2026-87121)
Vulnerability from cvelistv5 – Published: 2026-09-22 19:48 – Updated: 2026-09-22 20:23
VLAI
EPSS
VEX
Title
Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application
Summary
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 20:23 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| lwIP | TCP/IP Stack MQTT |
Affected:
2.0.1 , ≤ 2.2.1
(custom)
|
Date Public
2026-09-22 17:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T20:23:00.531481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:23:09.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TCP/IP Stack MQTT",
"vendor": "lwIP",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shahriyar Jalayeri of ByteRay Ltd. reported this vulnerability to CISA."
}
],
"datePublic": "2026-09-22T17:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "lwIP\u0026nbsp;TCP/IP Stack MQTT\u0026nbsp;is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device."
}
],
"value": "lwIP\u00a0TCP/IP Stack MQTT\u00a0is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:51:50.077Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://savannah.nongnu.org/projects/lwip"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u0026nbsp;\u003ca href=\"https://savannah.nongnu.org/projects/lwip\"\u003ehttps://savannah.nongnu.org/projects/lwip\u003c/a\u003e. The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1."
}
],
"value": "Users of lwIP are encouraged to update their version of lwIP using the repository found at\u00a0 https://savannah.nongnu.org/projects/lwip . The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1."
}
],
"source": {
"advisory": "ICSA-26-265-01",
"discovery": "EXTERNAL"
},
"title": "Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-87121",
"datePublished": "2026-09-22T19:48:25.046Z",
"dateReserved": "2026-09-09T21:28:27.099Z",
"dateUpdated": "2026-09-22T20:23:09.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}