CVE-2026-12522: Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields
The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr() in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-byte stack buffer, after which each address field length is computed from comma/. delimiter positions in the network-supplied data and used directly as the length argument to strncpy() into the fixed 64-byte stack buffer tempaddrstr (and the 16-byte ifacectx.dnsv4string).
Because the field length is derived from attacker-controlled delimiter positions and was not bounded against the destination buffer, a single field can be far larger than 64 bytes. A malicious or impersonated cellular network (for example a rogue base station) can return a crafted +CGCONTRDP response with an overlong address field, causing strncpy() to write past tempaddrstr on the modem worker thread's stack, plus an out-of-bounds NUL write at tempaddrstr[addrlen].
No device-side privileges or user interaction are required: the device itself issues the AT+CGCONTRDP=1 query during normal network attach and parses whatever the network returns. The overflow corrupts adjacent stack memory in supervisor context, yielding at minimum a remotely triggerable crash and potentially control-flow hijacking on targets without stack protection.
The fix bounds every field length against its destination buffer (tempaddrstr and dnsv4string) before each copy, rejecting overlong fields.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Devices using the Zephyr HL7800 cellular modem driver are exposed when they receive a crafted +CGCONTRDP response from the cellular network. The affected handler processes PDP-context parameters assigned by the network.
What does an attacker need to exploit this?
An attacker needs the ability to provide a malicious +CGCONTRDP response, such as through a malicious or impersonated cellular network or rogue base station. No device-side privileges or user interaction are required.
Is the vulnerable parsing path reached during ordinary operation?
Yes. The device issues the AT+CGCONTRDP=1 query during normal network operation, and the response is handled on the modem worker thread.