Executive brief
The lwIP TCP/IP Stack is a network communication library widely used in embedded devices across critical infrastructure sectors including power, water, healthcare, and transportation systems. An out-of-bounds write vulnerability in the MQTT Client Application allows unauthenticated remote attackers to execute arbitrary code on affected devices with no user interaction required, potentially gaining full control of industrial equipment and enabling operational disruption or data theft.
Technical details
The vulnerability is a CWE-787 out-of-bounds write in the lwIP MQTT Client Application affecting versions 2.0.1 through 2.2.1. The flaw allows an unauthenticated remote attacker to write data outside allocated memory boundaries, leading to memory corruption and arbitrary code execution. The attack vector is network-based with low attack complexity and no prerequisites (no authentication required, no user interaction). An attacker can craft malicious MQTT messages or network traffic to trigger the out-of-bounds write, resulting in complete device compromise. The fix has been made available via the lwIP repository; the relevant commit is f89407ea711879c04d91c92b35d67be78bbaf0f1.
Affected products
- lwIP lwIP TCP/IP Stack MQTT Client Application >=2.0.1, <=2.2.1
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory: CISA ICSA-26-265-01