Executive brief
The WNC-M14A2A LTE-M modem driver used in cellular IoT devices contains a flaw in how it processes network-derived cellular base station notifications. An attacker controlling a rogue cellular base station, or manipulating radio signals, can trigger out-of-bounds memory reads and writes on the modem by sending specially crafted notifications, leading to information disclosure and potential denial of service affecting modem connectivity.
Technical details
The vulnerability is a classic buffer over-read and out-of-bounds write in the on_cmd_socknotifyev() handler within the modem driver. The %NOTIFYEV: event payload is linearized into a fixed 40-byte stack buffer, capping the copy to 39 bytes; however, two quote-delimiter scanning loops incorrectly use the full CR/LF-delimited frame length instead of the actual linearized length, causing out-of-bounds stack reads when the frame exceeds 39 bytes and lacks quotes in the linearized region. If a quote byte is found in adjacent stack memory, a subsequent null-termination write occurs at an attacker-influenced offset, causing stack corruption. The payload carries network-derived content (LTIME, SIB1, CSPS/RRCSTATE) from the cellular base station, so exploitation requires no user interaction and triggers automatically in the modem RX thread. The impact includes out-of-bounds disclosure and denial of service; code execution is not demonstrated due to weak offset control. The fix bounds both scanning loops by the actual linearized length (out_len).
Affected products
- WNC WNC-M14A2A LTE-M modem driver unspecified
Timeline
- 2026-08-17: disclosed