Embedded-Security - CraftedSignal Threat Feed

U-Boot Use-After-Free in lwIP wget Implementation

hello@craftedsignal.io — Tue, 29 Sep 2026 22:30:13 +0000

U-Boot versions prior to 2026.10-rc5 contain a critical use-after-free vulnerability located within the httpc_recv_cb() function of the lwIP (lightweight IP) wget implementation. This flaw manifests when an HTTP data storage operation fails during the download process. In this failure state, the callback incorrectly frees the connection's Protocol Control Block (PCB) but proceeds to return an ERR_BUF status instead of the required ERR_ABRT. This discrepancy allows the TCP input path to subsequently reference the previously freed memory space, resulting in memory corruption and a hard crash of the bootloader. Because this occurs during the boot process, successful exploitation results in an immediate denial-of-service condition for the affected device.

Impact

The vulnerability poses a significant risk to embedded systems utilizing U-Boot for network-based boot processes. If successfully triggered, the vulnerability results in a system-wide denial-of-service, as the device becomes unable to complete the boot sequence. This is particularly relevant for hardware platforms configured to perform automated firmware updates or netboot operations via the U-Boot lwIP stack.

Recommendation

Upgrade U-Boot to version 2026.10-rc5 or later to receive the patch for CVE-2026-74222.
Audit network-accessible boot configurations on embedded devices to restrict access to trusted internal management subnets.
If immediate patching is not possible, disable the network-based boot features or the wget functionality in the U-Boot environment until the firmware can be updated.

Multiple Vulnerabilities in Wind River VxWorks 7

hello@craftedsignal.io — Tue, 29 Sep 2026 22:18:08 +0000

Wind River has identified multiple security vulnerabilities affecting VxWorks 7, a widely used real-time operating system (RTOS) in embedded devices, industrial control systems, and network infrastructure. These vulnerabilities can be exploited by a local attacker to disrupt service availability through denial-of-service (DoS) conditions, execute arbitrary code with elevated privileges, or perform unauthorized disclosure and manipulation of sensitive system data. Given the pervasive use of VxWorks in critical infrastructure and embedded systems, successful exploitation could lead to significant operational disruptions. Defenders should monitor for vendor updates and patches addressing these specific vulnerabilities as documented by Wind River's security advisories.

Impact

Successful exploitation of these vulnerabilities may lead to a complete denial of service for critical embedded systems, unauthorized remote or local code execution, and data corruption or exposure. These risks are particularly acute for organizations operating within critical infrastructure, medical device manufacturing, and industrial automation sectors that rely on VxWorks 7 for operational stability.

Recommendation

Prioritize the identification of devices running VxWorks 7 within the organization's asset inventory. Verify current firmware versions against the official Wind River security updates and apply relevant patches or mitigations provided by the vendor. Ensure that physical and local access controls for devices running VxWorks are strictly enforced to minimize the local access vector identified in this advisory.