Savannah lwIP SMTP client
Plan PatchCVSS 9.8ICS-CERT ICSA-26-279-02Oct 6, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A buffer overflow vulnerability exists in lwIP version 2.2.1 SMTP client code in the SMTP transmission buffer handling. Successful exploitation could crash the affected device or allow remote code execution. The vulnerability has been fixed in git commit 614420f82c8729d070e01464c0dddb3c9525c772 (patch_125_smtp_txbuf.diff).
What this means
What could happen
A buffer overflow in the SMTP client could allow an attacker to crash devices or run arbitrary code on systems using lwIP, potentially disrupting email notifications or control communications in industrial networks.
Who's at risk
Water utilities, electric utilities, and other operators using embedded devices or controllers based on lwIP (especially those relaying operational alerts or status emails). This includes networked sensors, RTUs (Remote Terminal Units), and any industrial equipment that uses lwIP for SMTP-based notifications.
How it could be exploited
An attacker on the network sends a specially crafted SMTP response to a device running vulnerable lwIP SMTP client code. The overflow occurs when the client processes the response without proper bounds checking, overwriting memory and allowing code execution or device crash.
Prerequisites
- Network access to the device's SMTP communication port (typically port 25, 465, or 587)
- The device must be configured to use lwIP SMTP client for email functionality
remotely exploitableno authentication requiredlow complexityaffects availability and integrity
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (1)
ProductAffected VersionsFix Status
lwIP SMTP client: 2.2.12.2.1No fix yet
Remediation & Mitigation
0/3
Do now
0/2WORKAROUNDIf patching is not immediately possible, disable SMTP email functionality on affected devices until a patch can be applied
HARDENINGSegment SMTP traffic: restrict network access to SMTP ports (25, 465, 587) from trusted mail servers only using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply patch_125_smtp_txbuf.diff (git commit 614420f82c8729d070e01464c0dddb3c9525c772) or rebuild lwIP with this patch applied
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/00bfa4df-d659-4166-aeed-3c057999ece7Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.