CVE Feed

    Dashboard / CVE / CVE-2020-10022

    CVE-2020-10022

    A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.

    Published:May 11, 2020
    Last Modified:Nov 21, 2024
    EPS:May 11, 2020
    EPSS Score:0.01697
    CVSS Score:9

    Affected Products

    Vendor
    Zephyrproject
    Product
    Zephyr

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-15461 (CVSS 5.3) — The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl7…
    CVE-2026-15460 (CVSS 5.4) — The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap…
    CVE-2026-14697 (CVSS 6.5) — net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When …
    CVE-2026-14696 (CVSS 6.5) — When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/et…
    CVE-2026-14368 (CVSS 5.4) — The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON s…
    CVE-2026-14367 (CVSS 3.1) — The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-…
    CVE-2026-14366 (CVSS 6.4) — The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c…
    CVE-2026-13735 (CVSS 3.7) — Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_…
    CVE-2026-13734 (CVSS 6.5) — Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_cry…
    CVE-2026-13481 (CVSS 5.4) — The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME managemen…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High