CVE-2026-13480
PoC moderateOut-of-bounds read in Zephyr RTOS LoRaWAN Fragmented Data Block Transport
CVE-2026-13480 is a bounded out-of-bounds read in the frag_transport_package_callback() handler of the LoRaWAN Fragmented Data Block Transport service in the Zephyr RTOS (subsys/lorawan/services/frag_transport.c), which parses downlink command bytes without validating that enough payload bytes remain before each access. An attacker who already holds the device's LoRaWAN session keys (the legitimate FUOTA server, or an attacker who has compromised those keys) can send a padded sequence of mismatched-index DATA_FRAGMENT commands followed by a matching-index fragment near the end of the 255-byte decrypted downlink buffer, causing the decoder to read up to roughly frag_size (default 232) bytes past the end of the MAC layer's static RxPayload buffer. The over-read copies adjacent static memory into the decoder buffers and the FUOTA flash image, potentially corrupting an over-the-air firmware update, but the bytes are never returned uplink, so there is no direct information-disclosure channel, no write or control-flow primitive, and on typical flat-memory MCUs a crash is unlikely. Only Zephyr-based LoRaWAN devices with the optional Fragmented Data Block Transport (FUOTA) service enabled are affected, and the flaw is reachable only on downlinks that have already passed frame MIC validation and FRMPayload decryption. No in-the-wild exploitation is known (EPSS 0.2%, not in CISA KEV); a public advisory with proof-of-concept details is available at GHSA-845m-2m84-g5h2.
What to do: Upgrade Zephyr to a release containing the remaining-length guards in frag_transport.c per the advisory GHSA-845m-2m84-g5h2 (fixed versions are listed there) and rebuild and re-flash any firmware that uses the Fragmented Data Block Transport service. Until patched, disable CONFIG_LORAWAN_FRAG_TRANSPORT on nodes that do not need fragmented FUOTA, and restrict FUOTA downlinks to the trusted FUOTA server while protecting session keys, since only key holders can trigger the flaw. No in-the-wild exploitation is reported, so prioritize patching devices that actively perform over-the-air firmware updates.
| Zephyr Project Zephyr RTOS - LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos frag_size, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232). rx_buf aliases the 255-byte static MacCtx.RxPayload buffer in the loramac-node MAC layer, while len is the actual decrypted payload length. By padding a downlink with mismatched-index DATA_FRAGMENT filler commands (each advancing rx_pos by three bytes without producing an answer) and appending one matching-index fragment near the end of the payload, an attacker can make the decoder read up to roughly frag_size bytes past the end of RxPayload, copying adjacent static memory into the decoder buffers and the FUOTA flash image. The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption, so the defect is reachable only by a party holding the device's session keys (the FUOTA server or an attacker who has compromised those keys). The out-of-bounds bytes are never returned to the sender — the only uplink emitted is a status answer carrying fragment counts — so there is no direct disclosure channel, and on typical flat-memory LoRaWAN MCUs the over-read stays within mapped memory, making a crash unlikely. The impact is therefore a bounded out-of-bounds read with limited confidentiality consequence and no write or control-flow primitive. The fix adds remaining-length guards before each access.
- Vendors
- zephyrproject
- Products
- zephyr
- Weakness
- CWE-20, CWE-125
- Vector
- CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
In the news0 stories
No ingested article mentions this CVE yet.