Executive brief
The Sierra Wireless HL7800 cellular modem driver used in embedded and IoT devices contains a critical flaw in how it parses responses from the cellular modem over a serial connection. An attacker with the ability to control or intercept modem communications—such as a rogue base station or compromised network peer—can send malformed cellular network messages that cause the driver to overflow a kernel memory buffer. This overflow could lead to a complete system crash, memory corruption, or potentially allow an attacker to execute arbitrary code with kernel-level privileges.
Technical details
The HL7800 modem driver in the Zephyr RTOS kernel parses AT command responses using approximately twenty handler functions that call net_buf_linearize() to read response fields into 128-byte stack buffers. The primary vulnerability is a stack buffer overflow in the +KCELLMEAS (cell measurement) handler, which incorrectly passes the wire-frame length as both source and destination size to net_buf_linearize(), allowing responses longer than 128 bytes to overflow the stack buffer with attacker-controlled content. Additionally, the remaining handlers perform single-byte out-of-bounds writes when response fields exactly fill the buffer, as net_buf_linearize() can return a count equal to its destination length, causing the NUL terminator to land one byte past the buffer. The data originates from the cellular modem via UART and is influenced by the cellular network (operator-scan results, IP/DNS configuration, socket indications, neighbor-cell reports). An attacker able to shape modem output—via a rogue base station, compromised modem firmware, or remote peer sending oversized AT response frames—can trigger the overflow. The handlers execute in the driver's RX thread in kernel context, making the corruption and any resulting code execution kernel-privileged. The fix bounds the buffer writes using sizeof(dst) - 1 to ensure the NUL terminator always remains within allocated memory.
Affected products
- Sierra Wireless HL7800 modem driver v4.4.0 and earlier (Zephyr RTOS)
Timeline
- 2026-08-18: disclosed
- 2026-08-18: advisory: CVE-2026-12520 published