A high-severity heap buffer overflow in the Zephyr hawkBit client could allow remote attackers to cause system crashes or potentially execute arbitrary code.

The hawkBit client fails to safely handle HTTP response bodies within the response_json_cb function, leading to a heap-based buffer overflow (CWE-122, CWE-787). This vulnerability can be triggered by a remote, unauthenticated attacker sending a specially crafted HTTP response to the device.

With a CVSS score of 8.2, this vulnerability represents a significant threat to device stability and security. Exploitation could lead to persistent denial of service or remote code execution on connected IoT devices, potentially compromising the integrity of managed fleets and enabling unauthorized control over embedded systems.

Immediate Action: Update the Zephyr RTOS codebase to version 4.5.0 or later to apply the necessary bounds checking for heap allocations.

Proactive Monitoring: Monitor network traffic directed toward the hawkBit client for unusually large or malformed HTTP JSON payloads.

Compensating Controls: Deploy network-level traffic inspection or a firewall to filter and validate incoming traffic from external update servers to the hawkBit management interface.

Public Exploit Available: Unknown.

Given the critical role of the hawkBit client in device management, this update must be treated as a high priority. Organizations utilizing Zephyr RTOS should verify their version and apply the patch to prevent potential remote exploitation of their device fleet.