OTPulse

lwIP TCP/IP Stack MQTT Client Application

Plan PatchCVSS 9.8ICS-CERT ICSA-26-265-01Sep 22, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A buffer overflow vulnerability (CWE-787) exists in the lwIP TCP/IP stack used by MQTT Client Applications versions 2.0.1 through 2.2.1. Successful exploitation allows an attacker to execute arbitrary code on the affected device by sending a specially crafted network packet. The vulnerability is remotely exploitable without authentication or user interaction.

What this means
What could happen
An attacker could achieve full code execution on devices running vulnerable MQTT client applications, potentially allowing them to take control of the device and manipulate any operations or data it handles.
Who's at risk
Water utilities, electric utilities, and other industrial facilities using MQTT-based monitoring and control systems are affected. This includes any device running the vulnerable MQTT Client Application (versions 2.0.1–2.2.1) that relies on lwIP for TCP/IP networking, such as industrial IoT sensors, remote terminal units (RTUs), programmable logic controllers (PLCs) with MQTT connectivity, and network switches with embedded MQTT agents.
How it could be exploited
An attacker could send a specially crafted network packet to an MQTT client application running the vulnerable lwIP stack. The packet would trigger a buffer overflow vulnerability (CWE-787) in the TCP/IP stack, allowing the attacker to execute arbitrary code on the device.
Prerequisites
  • Network reachability to the device running the vulnerable MQTT client application
  • Device must be running MQTT Client Application versions 2.0.1 through 2.2.1
Remotely exploitableNo authentication requiredLow complexityCritical severity (CVSS 9.8)Buffer overflow vulnerabilityFull code execution possible
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (1)
ProductAffected VersionsFix Status
MQTT Client Application: >=2.0.1|<=2.2.1≥ 2.0.1|≤ 2.2.1No fix yet
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict network access to MQTT client devices to only trusted systems and networks using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate lwIP TCP/IP stack using the official repository at https://savannah.nongnu.org/projects/lwip to include commit f89407ea711879c04d91c92b35d67be78bbaf0f1 or later
Long-term hardening
0/1
HARDENINGSegment MQTT client devices onto a protected network isolated from untrusted external networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/731011d3-599f-45a9-af46-f217c94a88f6

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.