CVE-2026-13479

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description The LoRaWAN application-layer clock-synchronization service contains an issue in the clock sync package callback() function within subsys/lorawan/services/clock sync.c. When processing the CLOCK SYNC CMD APP TIME (AppTimeAns) command, the handler reads a 4-byte time correction using sys get le32() and a 1-byte token without verifying if 5 bytes remain in the receive buffer. This allows a short or crafted AppTimeAns to read up to 5 bytes beyond the end of the decrypted payload.

Exploitation requires a frame that passes MAC integrity checks and decryption, meaning the attacker must be a compromised network/application server or possess the session keys. Because the data is read from a fixed 255-byte static buffer, the over-read does not cause a crash or information disclosure. However, if a stale token matches ctx.req token, an incorrect time correction may be applied to the device's ctx.time offset, affecting the device's internal time estimate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.