lwIP Patches a 9.8-Severity Flaw in Its MQTT Client

A critical flaw in the MQTT client bundled with lwIP, an open-source networking stack embedded in industrial and consumer devices worldwide, lets an attacker execute code on the device without a password, the Cybersecurity and Infrastructure Security Agency said in an advisory published Sept. 22.

CISA rated the bug, CVE-2026-87121, 9.8 out of 10 on the CVSS 3.1 scale, its highest tier short of a perfect score, and 9.3 on the newer CVSS 4.0 scale. Security researcher Shahriyar Jalayeri of ByteRay Ltd. reported the flaw to CISA. It affects lwIP's MQTT client in versions 2.0.1 through 2.2.1 and is tracked as CWE-787, an out-of-bounds write.

What the flaw actually does

CISA's advisory does not walk through the specific code path, but its risk evaluation is blunt: successful exploitation could allow an attacker to gain full code execution on the device. The CVSS vector CISA published, AV:N/AC:L/PR:N/UI:N, means the attack can be launched over a network, needs no special access conditions, requires no privileges on the target and needs no action from a user sitting in front of it.

An unglamorous library nobody inventories

lwIP, a small independent implementation of the TCP/IP protocol suite built to run inside the limited memory of a microcontroller, was originally written by Adam Dunkels at the Swedish Institute of Computer Science and is now maintained by a worldwide network of volunteer developers through a Savannah repository, according to the project's own GitHub mirror. CISA's advisory lists the vendor as headquartered in Sweden and says the library is deployed worldwide across eight critical-infrastructure sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater systems.

None of those device makers necessarily say which network stack they used. A control system built around lwIP's MQTT client can run the vulnerable code with lwIP never appearing on an equipment list or purchase order, the same blind spot that follows Espressif's newest microcontroller the moment a customer solders it into a product line without documenting the networking stack underneath.

The fix, and what CISA is not saying

lwIP shipped its fix as commit f89407ea711879c04d91c92b35d67be78bbaf0f1 on its Savannah repository, according to CISA's advisory, rather than in a numbered point release; the MQTT client's version scheme does not map to a single downloadable build the way a desktop application's does. CISA said it is not aware of the vulnerability being exploited, and it has published no list of the products or vendors that bundle the affected client. That silence matches how CISA handled its Sept. 24 addition of WSO2 and Adobe Commerce bugs to its separate Known Exploited Vulnerabilities catalog: a technical fix with no accompanying count of how many deployments remain exposed.

CVSS 3.1	CVSS 4.0	CWE	Affected versions
9.8	9.3	CWE-787, out-of-bounds write	2.0.1 through 2.2.1

Operators running lwIP's MQTT client have no version number to check against a vendor changelog. The only way to confirm a device is fixed is to compare its deployed source tree against the commit CISA named, a step that assumes whoever built the device kept a record of which lwIP revision they started from.