CVE-2026-87121

Summary

The lwIP TCP/IP Stack MQTT implementation is vulnerable to an out-of-bounds write, enabling full code execution on the device. This flaw is critical as it allows attackers to gain control over the device.

Exploitability

Exploitation requires network access and knowledge of the affected MQTT implementation. Precondition is the presence of the vulnerable lwIP version and active MQTT communication.

Blast radius

If exploited, the attacker could gain full control over the device, leading to potential data theft, device compromise, or further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the lwIP version 2.1.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.