A memory-safety bug in a widely used embedded networking library could let an attacker take over IoT devices with a single malformed MQTT message.
CISA disclosed a critical out-of-bounds write vulnerability in the MQTT client component of lwIP, an open-source TCP/IP stack embedded in industrial and consumer devices. The flaw affects lwIP versions 2.0.1 through 2.2.1 and carries a CVSS 3.1 score of 9.8 out of 10, with a CVSS 4.0 score of 9.3, both near the top of the severity scale. The vulnerability requires no privileges and no user interaction to exploit, and successful exploitation could give an attacker full code execution on the device. A fix already exists as a specific commit in the lwIP source repository, though it is up to individual manufacturers to build and ship it.
lwIP isn't a brand name most people know, but it's the kind of infrastructure that shows up everywhere precisely because it's small, free, and easy to embed. That ubiquity is the risk: a single stack-level bug can touch every downstream product built on it, and unlike consumer software, embedded devices often go years without a firmware update, let alone a security patch.
CISA reports no known public exploitation so far. A 9.8-severity, full-code-execution bug in a library this widely deployed rarely stays theoretical for long.