A memory safety flaw in the Zephyr RTOS UpdateHub agent enables remote unauthenticated attackers to trigger a denial of service condition on affected firmware.

The vulnerability exists in the UpdateHub firmware-update agent within the z_impl_updatehub_probe function. It is a memory safety issue (CWE-476) that can be triggered by an unauthenticated remote attacker, resulting in a denial of service.

The ability for a remote attacker to crash the firmware-update agent can result in significant system downtime and operational disruption. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, particularly for critical infrastructure or embedded devices relying on the Zephyr RTOS.

Immediate Action: Update the Zephyr project firmware to version 4.4.2 or the latest available patched release to remediate the memory safety vulnerability.

Proactive Monitoring: Monitor device stability and watch for unexpected reboots or service failures in the UpdateHub agent.

Compensating Controls: Implement network-level access controls to restrict access to the firmware-update management interfaces to trusted IP addresses only.

Public Exploit Available: Unknown

Given the potential for denial of service in embedded environments, organizations should prioritize updating their Zephyr-based firmware. Ensure that all affected devices are patched to version 4.4.2 to maintain operational continuity.