CVE-2026-12522

Name of the Vulnerable Software and Affected Versions HL7800 cellular modem driver (affected versions not specified)

Description The on cmd atcmdinfo ipaddr() function in the +CGCONTRDP: response handler fails to properly bound the length of PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) before copying them into fixed-size stack buffers. Specifically, the length of these fields is derived from delimiter positions in data supplied by the cellular network and used as the length argument for strncpy() into the temp addr str (64 bytes) and iface ctx.dns v4 string (16 bytes) buffers. A malicious or impersonated cellular network, such as a rogue base station, can provide a crafted response with an overlong address field to cause a stack-based buffer overflow and an out-of-bounds NUL write. This issue can be triggered during normal network attach without user interaction, potentially leading to a system crash or remote control-flow hijacking in supervisor context on systems lacking stack protection.

Recommendations Update the HL7800 cellular modem driver to a version where field lengths are bounded against the destination buffers temp addr str and dns v4 string before copying.