CVE-2026-13480— LoRaWAN 下行处理器越界读取漏洞
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是该漏洞描述的中文翻译： LoRaWAN TS004 分块数据块传输处理器 （位于 ）在解析下行命令字节时，未在校验每次访问前是否还有足够的负载字节。该循环唯一的边界条件是 ；在消耗掉 1 字节的命令 ID 后，处理器将 强制转换为 10 字节的结构体 ；对于 命令，则将 传递给分块解码器，该解码器会精确读取 个字节——在这两种情况下，均没有对剩余长度进行检查。 分块大小是由攻击者在之前的 命令中指定的（ ，上限为 ，默认值为 232）。 是 LoRaMAC 节点 MAC 层中 255 字节静态 缓冲区的别名，
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-13480 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
来源: CVE Program / CVE List V5
Vulnerability Description
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos < len; after consuming the one-byte command id the handler cast rx_buf + rx_pos to a 10-byte struct frag_transport_setup_req, and for a DATA_FRAGMENT command passed &rx_buf[rx_pos] to the fragment decoder, which reads exactly ctx.frag_size bytes — with no remaining-length check in either case.
The fragment size is attacker-chosen in a preceding FRAG_SESSION_SETUP command (ctx.frag_size = req->frag_size, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232). rx_buf aliases the 255-byte static MacCtx.RxPayload buffer in the loramac-node MAC layer, while len is the actual decrypted payload length. By padding a downlink with mismatched-index DATA_FRAGMENT filler commands (each advancing rx_pos by three bytes without producing an answer) and appending one matching-index fragment near the end of the payload, an attacker can make the decoder read up to roughly frag_size bytes past the end of RxPayload, copying adjacent static memory into the decoder buffers and the FUOTA flash image.
The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption, so the defect is reachable only by a party holding the device's session keys (the FUOTA server or an attacker who has compromised those keys). The out-of-bounds bytes are never returned to the sender — the only uplink emitted is a status answer carrying fragment counts — so there is no direct disclosure channel, and on typical flat-memory LoRaWAN MCUs the over-read stays within mapped memory, making a crash unlikely. The impact is therefore a bounded out-of-bounds read with limited confidentiality consequence and no write or control-flow primitive. The fix adds remaining-length guards before each access.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
来源: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.7.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-13480 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-13480 的情报信息
请登录查看更多情报信息。
CVE-2026-13480 补丁与修复 (1)
CVE-2026-13480 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-08-26 · 共 3 条
| CVE-2026-13481 | 5.4 MEDIUM | Zephyr PTP时间解析越界读取漏洞 |
| CVE-2026-13479 | 3.1 LOW | LoRaWAN 时钟同步应用时间应答越界读取漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-13480
暂无评论