CVE-2021-3966

Usb bluetooth device ACL read cb buffer overflow

usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2022-0553

Possible to retrieve uncrypted firmware image

There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-0396

Buffer Overreads in Bluetooth HCI

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-0397

DoS: Invalid Initialization in le_read_buffer_size_complete

A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-7060

Missing Security Control in Zephyr OS IP Packet Handling

Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2021-3329

DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer

Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2025-1673

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2025-1674

Out of bounds read when unpacking DNS answers

A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-5753

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c

CVSS 3.1 · 6.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-5139

Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver

Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-4260

Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem

Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-4265

Buffer overflow in Zephyr USB

Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis... https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/usb/device/class/netusb/function_rndis.c#L841

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-4263

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-4259

Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-4257

Unchecked user input length in the Zephyr WiFi shell module

Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.

CVSS 3.1 · 7.6 High EPSS 1.1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-3725

Potential buffer overflow vulnerability in the Zephyr CANbus subsystem

Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

CVSS 3.1 · 7.6 High EPSS 1.3% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2023-0779

net: shell: Improper input validation

At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2024-11263

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Zephyrproject Zephyrproject-rtos

Products

Zephyr Zephyr

CVE-2024-3332

bt: host/smp: DoS caused by null pointer dereference

A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr

CVE-2024-3077

Bluetooth: integer underflow in gatt_find_info_rsp

An malicious BLE device can crash BLE victim device by sending malformed gatt packet

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Zephyrproject

Products

Zephyr