# Zephyr.

Every CVE that names Zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [BT: Classic: SDP OOB access in get_att_search_list](https://agentprime.io/advisories/CVE-2024-6137.md)
  `CVE-2024-6137` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 13 Sept 2024 · Tags: Memory corruption
- [BT:Classic: Multiple missing buf length checks](https://agentprime.io/advisories/CVE-2024-6135.md)
  `CVE-2024-6135` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 13 Sept 2024 · Tags: Memory corruption
- [BT: Unchecked user input in bap_broadcast_assistant](https://agentprime.io/advisories/CVE-2024-5931.md)
  `CVE-2024-5931` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: Memory corruption, CWE-1284
- [BT: Missing length checks of net_buf in rfcomm_handle_data](https://agentprime.io/advisories/CVE-2024-6258.md)
  `CVE-2024-6258` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.8 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: Memory corruption
- [BT: Encryption procedure host vulnerability](https://agentprime.io/advisories/CVE-2024-5754.md)
  `CVE-2024-5754` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-807
- [BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero](https://agentprime.io/advisories/CVE-2024-4785.md)
  `CVE-2024-4785` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 19 Aug 2024 · Tags: Denial of service
- [bt: host/smp: DoS caused by null pointer dereference](https://agentprime.io/advisories/CVE-2024-3332.md)
  `CVE-2024-3332` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Memory corruption
- [Bluetooth: integer underflow in gatt_find_info_rsp](https://agentprime.io/advisories/CVE-2024-3077.md)
  `CVE-2024-3077` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.8 Medium · Not analysed yet · Published 29 Mar 2024 · Tags: Memory corruption, CWE-126
- [Missing Security Control in Zephyr OS IP Packet Handling](https://agentprime.io/advisories/CVE-2023-7060.md)
  `CVE-2023-7060` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.6 High · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-20
- [fs: fuse: buffer overflow vulnerability in the Zephyr FS](https://agentprime.io/advisories/CVE-2023-6881.md)
  `CVE-2023-6881` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.3 High · Not analysed yet · Published 20 Feb 2024 · Tags: Memory corruption
- [Bluetooth characteristic LESC security requirement not enforced without additional flags](https://agentprime.io/advisories/CVE-2024-1638.md)
  `CVE-2024-1638` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 19 Feb 2024 · Tags: CWE-20
- [can: out of bounds in remove_rx_filter function](https://agentprime.io/advisories/CVE-2023-5779.md)
  `CVE-2023-5779` · CVE record: zephyrproject-rtos Zephyr · CVSS 4.4 Medium · Not analysed yet · Published 18 Feb 2024 · Tags: Memory corruption
- [ipm: signed to unsigned conversion problem in esp32_ipm_send](https://agentprime.io/advisories/CVE-2023-6249.md)
  `CVE-2023-6249` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.0 High · Not analysed yet · Published 18 Feb 2024 · Tags: CWE-704
- [Unchecked user input length in the Zephyr Settings Shell](https://agentprime.io/advisories/CVE-2023-6749.md)
  `CVE-2023-6749` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.0 High · Not analysed yet · Published 18 Feb 2024 · Tags: Memory corruption
- [L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()](https://agentprime.io/advisories/CVE-2023-5055.md)
  `CVE-2023-5055` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.3 High · Not analysed yet · Published 21 Nov 2023 · Tags: Memory corruption
- [bt: hci: DoS and possible RCE](https://agentprime.io/advisories/CVE-2023-4424.md)
  `CVE-2023-4424` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.3 High · Not analysed yet · Published 21 Nov 2023 · Tags: Memory corruption
- [Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver](https://agentprime.io/advisories/CVE-2023-5139.md)
  `CVE-2023-5139` · CVE record: zephyrproject-rtos Zephyr · CVSS 4.4 Medium · Not analysed yet · Published 26 Oct 2023 · Tags: Memory corruption
- [Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem](https://agentprime.io/advisories/CVE-2023-5753.md)
  `CVE-2023-5753` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 24 Oct 2023 · Tags: Memory corruption
- [Unchecked user input length in the Zephyr WiFi shell module](https://agentprime.io/advisories/CVE-2023-4257.md)
  `CVE-2023-4257` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2023 · Tags: Memory corruption
- [Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver](https://agentprime.io/advisories/CVE-2023-4263.md)
  `CVE-2023-4263` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2023 · Tags: Memory corruption
- [The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y.](https://agentprime.io/advisories/CVE-2023-5563.md)
  `CVE-2023-5563` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2023 · Tags: CWE-703
- [Potential buffer overflow vulnerability in the Zephyr CANbus subsystem](https://agentprime.io/advisories/CVE-2023-3725.md)
  `CVE-2023-3725` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 6 Oct 2023 · Tags: Memory corruption
- [Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver](https://agentprime.io/advisories/CVE-2023-5184.md)
  `CVE-2023-5184` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.0 High · Not analysed yet · Published 27 Sept 2023 · Tags: Memory corruption, CWE-195
- [Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem](https://agentprime.io/advisories/CVE-2023-4260.md)
  `CVE-2023-4260` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: Memory corruption, CWE-193
- [Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem](https://agentprime.io/advisories/CVE-2023-4264.md)
  `CVE-2023-4264` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2023 · Tags: Memory corruption
- [Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver](https://agentprime.io/advisories/CVE-2023-4259.md)
  `CVE-2023-4259` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2023 · Tags: Memory corruption, CWE-193
- [bt: mesh: vulnerability in provisioning protocol implementation on provisionee side](https://agentprime.io/advisories/CVE-2023-4258.md)
  `CVE-2023-4258` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.6 High · Not analysed yet · Published 25 Sept 2023 · Tags: CWE-684
- [Buffer overflow in Zephyr USB](https://agentprime.io/advisories/CVE-2023-4265.md)
  `CVE-2023-4265` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.4 Medium · Not analysed yet · Published 12 Aug 2023 · Tags: Memory corruption
- [HCI send_sync Dangling Semaphore Reference Re-use](https://agentprime.io/advisories/CVE-2023-1901.md)
  `CVE-2023-1901` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-672
- [BT HCI host union variant confusion](https://agentprime.io/advisories/CVE-2023-2234.md)
  `CVE-2023-2234` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.8 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: Memory corruption
- [HCI Connection Creation Dangling State Reference Re-use](https://agentprime.io/advisories/CVE-2023-1902.md)
  `CVE-2023-1902` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-672
- [ipv6: Missing ipv6 nullptr-check in handle_ra_input](https://agentprime.io/advisories/CVE-2023-0359.md)
  `CVE-2023-0359` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.9 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-20
- [net: shell: Improper input validation](https://agentprime.io/advisories/CVE-2023-0779.md)
  `CVE-2023-0779` · CVE record: zephyrproject-rtos zephyr · CVSS 6.7 Medium · Not analysed yet · Published 30 May 2023 · Tags: CWE-20
- [DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer](https://agentprime.io/advisories/CVE-2021-3329.md)
  `CVE-2021-3329` · CVE record: zephyrproject-rtos zephyr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2023 · Tags: CWE-703
- [DoS: Invalid Initialization in le_read_buffer_size_complete](https://agentprime.io/advisories/CVE-2023-0397.md)
  `CVE-2023-0397` · CVE record: zephyrproject-rtos zephyr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-703
- [Buffer Overreads in Bluetooth HCI](https://agentprime.io/advisories/CVE-2023-0396.md)
  `CVE-2023-0396` · CVE record: zephyrproject-rtos zephyr · CVSS 6.8 Medium · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-126
- [Bluetooth HCI Error Handling Double Free](https://agentprime.io/advisories/CVE-2022-3806.md)
  `CVE-2022-3806` · CVE record: zephyrproject-rtos zephyr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: Memory corruption
- [Possible to retrieve uncrypted firmware image](https://agentprime.io/advisories/CVE-2022-0553.md)
  `CVE-2022-0553` · CVE record: zephyrproject-rtos zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Jan 2023 · Tags: Information disclosure
- [Usb bluetooth device ACL read cb buffer overflow](https://agentprime.io/advisories/CVE-2021-3966.md)
  `CVE-2021-3966` · CVE record: zephyrproject-rtos zephyr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jan 2023 · Tags: Memory corruption
- [bt: host: Wrong key validation check](https://agentprime.io/advisories/CVE-2022-2993.md)
  `CVE-2022-2993` · CVE record: zephyrproject-rtos zephyr · CVSS 8.6 High · Not analysed yet · Published 12 Dec 2022 · Tags: CWE-670
- [can: denial-of-service can be triggered by a crafted CAN frame](https://agentprime.io/advisories/CVE-2022-2741.md)
  `CVE-2022-2741` · CVE record: zephyrproject-rtos zephyr · CVSS 8.2 High · Not analysed yet · Published 31 Oct 2022 · Tags: Denial of service
- [Out-of-bound write in tcp_flags](https://agentprime.io/advisories/CVE-2022-1841.md)
  `CVE-2022-1841` · CVE record: zephyrproject-rtos zephyr · CVSS 7.2 High · Not analysed yet · Published 31 Aug 2022 · Tags: Memory corruption
- [Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning](https://agentprime.io/advisories/CVE-2022-1042.md)
  `CVE-2022-1042` · CVE record: zephyrproject-rtos zephyr · CVSS 8.2 High · Not analysed yet · Published 26 Jul 2022 · Tags: Memory corruption
- [Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning](https://agentprime.io/advisories/CVE-2022-1041.md)
  `CVE-2022-1041` · CVE record: zephyrproject-rtos zephyr · CVSS 8.2 High · Not analysed yet · Published 26 Jul 2022 · Tags: Memory corruption
- [L2CAP: Information leakage in le_ecred_conn_req()](https://agentprime.io/advisories/CVE-2021-3435.md)
  `CVE-2021-3435` · CVE record: zephyrproject-rtos zephyr · CVSS 4.0 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Memory corruption
- [L2CAP: Stack based buffer overflow in le_ecred_conn_req()](https://agentprime.io/advisories/CVE-2021-3434.md)
  `CVE-2021-3434` · CVE record: zephyrproject-rtos zephyr · CVSS 4.9 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Memory corruption
- [BT: Invalid channel map in CONNECT_IND results to Deadlock](https://agentprime.io/advisories/CVE-2021-3433.md)
  `CVE-2021-3433` · CVE record: zephyrproject-rtos zephyr · CVSS 4.0 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: CWE-703
- [BT: Invalid interval in CONNECT_IND leads to Division by Zero](https://agentprime.io/advisories/CVE-2021-3432.md)
  `CVE-2021-3432` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Denial of service
- [BT: Assertion failure on repeated LL_FEATURE_REQ](https://agentprime.io/advisories/CVE-2021-3431.md)
  `CVE-2021-3431` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Denial of service
- [BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQ](https://agentprime.io/advisories/CVE-2021-3430.md)
  `CVE-2021-3430` · CVE record: zephyrproject-rtos zephyr · CVSS 6.5 Medium · Not analysed yet · Published 28 Jun 2022 · Tags: Denial of service
- [The RNDIS USB device class includes a buffer overflow vulnerability](https://agentprime.io/advisories/CVE-2021-3861.md)
  `CVE-2021-3861` · CVE record: zephyrproject-rtos zephyr · CVSS 8.2 High · Not analysed yet · Published 7 Feb 2022 · Tags: Memory corruption
- [Buffer overflow in usb device class](https://agentprime.io/advisories/CVE-2021-3835.md)
  `CVE-2021-3835` · CVE record: zephyrproject-rtos zephyr · CVSS 8.2 High · Not analysed yet · Published 7 Feb 2022 · Tags: Memory corruption
- [Truncated L2CAP K-frame causes assertion failure](https://agentprime.io/advisories/CVE-2021-3454.md)
  `CVE-2021-3454` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Denial of service, CWE-130
- [Disconnecting L2CAP channel right after invalid ATT request leads freeze](https://agentprime.io/advisories/CVE-2021-3455.md)
  `CVE-2021-3455` · CVE record: zephyrproject-rtos zephyr · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: Memory corruption
- [RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr](https://agentprime.io/advisories/CVE-2021-3330.md)
  `CVE-2021-3330` · CVE record: zephyrproject-rtos zephyr · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2021 · Tags: Memory corruption
- [Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr](https://agentprime.io/advisories/CVE-2021-3323.md)
  `CVE-2021-3323` · CVE record: zephyrproject-rtos zephyr · CVSS 8.3 High · Not analysed yet · Published 12 Oct 2021 · Tags: Memory corruption
- [Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr](https://agentprime.io/advisories/CVE-2021-3322.md)
  `CVE-2021-3322` · CVE record: zephyrproject-rtos zephyr · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2021 · Tags: Memory corruption
- [Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal](https://agentprime.io/advisories/CVE-2021-3321.md)
  `CVE-2021-3321` · CVE record: zephyrproject-rtos zephyr · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2021 · Tags: Memory corruption
- [Buffer overflow in Zephyr USB DFU DNLOAD](https://agentprime.io/advisories/CVE-2021-3625.md)
  `CVE-2021-3625` · CVE record: zephyrproject-rtos zephyr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2021 · Tags: Memory corruption
- [Buffer Access with Incorrect Length Value in zephyr](https://agentprime.io/advisories/CVE-2021-3581.md)
  `CVE-2021-3581` · CVE record: zephyrproject-rtos zephyr · CVSS 7.0 High · Not analysed yet · Published 5 Oct 2021 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/zephyr.md>
Older: <https://agentprime.io/advisories/technology/zephyr.md?cursor=WyIyMDIxLTEwLTA1VDIwOjUwOjE4LjgyNjAwMFoiLCJDVkUtMjAyMS0zNTgxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zephyr&cursor=WyIyMDI0LTA5LTEzVDIwOjE3OjU4LjgyNzAwMFoiLCJDVkUtMjAyNC02MjU5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zephyr/?cursor=WyIyMDI0LTA5LTEzVDIwOjE3OjU4LjgyNzAwMFoiLCJDVkUtMjAyNC02MjU5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.