Executive brief
SWUpdate is an open-source framework used to manage software updates on embedded Linux systems. A flaw in how it handles file uploads allows an unauthenticated attacker to crash the update service by sending a specially crafted web request. This can prevent the device from receiving critical software updates and disrupt normal operations.
Technical details
An integer underflow exists in the mongoose_multipart.c component of SWUpdate within the mg_http_multipart_continue_wait_for_chunk() function. The vulnerability is caused by a logic mismatch between a guard condition and a subsequent subtraction operation when calculating data length; specifically, the guard checks for a length of +6 while the subtraction uses +8. When the buffer length falls between these values, a size_t underflow occurs, leading to an out-of-bounds heap read. An attacker can exploit this by sending a crafted HTTP POST request to the /upload endpoint with a malformed multipart boundary and specific TCP timing to trigger a denial of service. A patch is available in commit beee2dc.
Affected products
- sbabic SWUpdate <= 2025.12
Timeline
- 2026-04-23: disclosed
- 2026-04-23: advisory
- 2026-04-23: patched: Fixed in commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74