{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/osdp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-76788"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zephyr RTOS"],"_cs_severities":["high"],"_cs_tags":["zephyr","rtos","buffer-overflow","osdp"],"_cs_type":"advisory","_cs_vendors":["Zephyr Project"],"content_html":"\u003cp\u003eCVE-2026-76788 identifies a critical buffer overflow vulnerability within the Open Supervised Device Protocol (OSDP) implementation in the Zephyr RTOS, specifically within the \u003ccode\u003ecp_decode_response()\u003c/code\u003e function. This vulnerability stems from improper bounds checking when handling \u003ccode\u003eREPLY_KEYPAD\u003c/code\u003e and \u003ccode\u003eREPLY_RAW\u003c/code\u003e frames, which are copied into stack-allocated \u003ccode\u003eosdp_event\u003c/code\u003e structures. Because the code trusts length fields provided by the Peripheral Device without validating them against the \u003ccode\u003eOSDP_EVENT_MAX_DATALEN\u003c/code\u003e constant, an attacker can supply an oversized payload.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is accessible to any entity with physical access to the RS-485 wiring, such as a compromised or malicious card reader. Even if Secure Channel (SC) communication is enabled, an attacker can force a secure channel deactivation by sending a single unauthenticated frame with an invalid MAC, effectively reverting the connection to plaintext. The resulting overflow can overwrite stack-based return addresses or registers on Cortex-M or RISC-V architectures, leading to either a system crash (Denial of Service) or arbitrary code execution in the context of the OSDP receive thread.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains physical access to the RS-485 wiring connecting a peripheral device to the OSDP Control Panel.\u003c/li\u003e\n\u003cli\u003eAttacker transmits an unauthenticated frame with an incorrect MAC to the Control Panel to trigger \u003ccode\u003esc_deactivate()\u003c/code\u003e and disable secure channel protection.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious OSDP frame containing a \u003ccode\u003eREPLY_KEYPAD\u003c/code\u003e or \u003ccode\u003eREPLY_RAW\u003c/code\u003e message ID.\u003c/li\u003e\n\u003cli\u003eAttacker includes a payload length in the frame that exceeds the 64-byte \u003ccode\u003eOSDP_EVENT_MAX_DATALEN\u003c/code\u003e limit.\u003c/li\u003e\n\u003cli\u003eThe Control Panel's \u003ccode\u003eosdp_process_reply()\u003c/code\u003e function processes the packet after it passes initial CRC-16 checks.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecp_decode_response()\u003c/code\u003e fails to validate the payload length and proceeds to \u003ccode\u003ememcpy()\u003c/code\u003e the oversized data into the stack-allocated \u003ccode\u003eosdp_event\u003c/code\u003e structure.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ememcpy()\u003c/code\u003e operation overflows the stack buffer, overwriting adjacent memory including saved registers and the return address.\u003c/li\u003e\n\u003cli\u003eThe OSDP thread returns execution to an attacker-controlled address, leading to arbitrary code execution or a system crash.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits unauthorized control over access-control panels. An attacker may achieve persistent remote code execution on the device, potentially bypassing security gates, manipulating access logs, or disrupting facility security infrastructure. The vulnerability affects all systems utilizing Zephyr RTOS with the \u003ccode\u003eCONFIG_OSDP\u003c/code\u003e and \u003ccode\u003eCONFIG_OSDP_MODE_CP\u003c/code\u003e features enabled, provided they do not implement manual stack-protection mitigations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all affected Zephyr RTOS deployments to a version that includes the fix for CVE-2026-76788, which explicitly adds bounds checking for \u003ccode\u003eREPLY_KEYPAD\u003c/code\u003e and \u003ccode\u003eREPLY_RAW\u003c/code\u003e handlers using \u003ccode\u003eOSDP_EVENT_MAX_DATALEN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict physical access to RS-485 bus wiring to prevent unauthorized device injection or frame manipulation.\u003c/li\u003e\n\u003cli\u003eEnable stack protection mechanisms (e.g., stack canaries) in Zephyr RTOS configurations to detect or mitigate buffer overflow attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T22:24:23Z","date_published":"2026-10-19T22:24:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-osdp-overflow/","summary":"A vulnerability in the Zephyr RTOS OSDP Control Panel implementation allows attackers with access to the RS-485 bus to trigger a stack-based buffer overflow and potential code execution.","title":"Stack-Based Buffer Overflow in Zephyr RTOS OSDP Implementation","url":"https://feed.craftedsignal.io/briefs/2026-10-osdp-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Osdp","version":"https://jsonfeed.org/version/1.1"}