Zephyr vulnerabilitiesRanked by how likely they are to be used.
Zephyr is made by Zephyrproject. We track 115 published vulnerabilities in it, across 66 versions. None of them is on the list of flaws known to be exploited today. If you run Zephyr, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Zephyr vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Zephyr's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Zephyr flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 3.4%CVE-2020-10071Critical
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution.
- 2.9%CVE-2020-10070Critical
In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution.
- 2.9%CVE-2020-10062Critical
An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution.
- 2.3%CVE-2020-10022Critical
A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS.
- 2.3%CVE-2021-3625Critical
Buffer overflow in Zephyr USB DFU DNLOAD.
- 1.8%CVE-2020-10063High
A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service.
- 1.7%CVE-2017-14199Critical
A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.
- 1.7%CVE-2018-1000800Critical
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010).
- 1.6%CVE-2020-10060Medium
In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places.
- 1.3%CVE-2023-3725Critical
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
Running Zephyr? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
- Matched to
- Zephyr on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 115 published vulnerabilities listed under the name Zephyr, across 66 versions.
None of Zephyr's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Zephyr. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.