lwIP Patches a 9.8-Severity Flaw in Its MQTT Client
Security / news
lwIP Patches a 9.8-Severity Flaw in Its MQTT Client
CISA says the out-of-bounds write in lwIP's MQTT client, deployed in energy, water and healthcare gear worldwide, lets an attacker reach full code execution with no login needed.
A critical flaw in the MQTT client bundled with lwIP, an open-source networking stack embedded in industrial and consumer devices worldwide, lets an attacker execute code on the device without a password, the Cybersecurity and Infrastructure Security Agency said in an advisory published Sept. 22.
CISA rated the bug, CVE-2026-87121, 9.8 out of 10 on the CVSS 3.1 scale, its highest tier short of a perfect score, and 9.3 on the newer CVSS 4.0 scale. Security researcher Shahriyar Jalayeri of ByteRay Ltd. reported the flaw to CISA. It affects lwIP's MQTT client in versions 2.0.1 through 2.2.1 and is tracked as CWE-787, an out-of-bounds write.
What the flaw actually does
CISA's advisory does not walk through the specific code path, but its risk evaluation is blunt: successful exploitation could allow an attacker to gain full code execution on the device. The CVSS vector CISA published, AV:N/AC:L/PR:N/UI:N, means the attack can be launched over a network, needs no special access conditions, requires no privileges on the target and needs no action from a user sitting in front of it.
An unglamorous library nobody inventories
lwIP, a small independent implementation of the TCP/IP protocol suite built to run inside the limited memory of a microcontroller, was originally written by Adam Dunkels at the Swedish Institute of Computer Science and is now maintained by a worldwide network of volunteer developers through a Savannah repository, according to the project's own GitHub mirror. CISA's advisory lists the vendor as headquartered in Sweden and says the library is deployed worldwide across eight critical-infrastructure sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater systems.
None of those device makers necessarily say which network stack they used. A control system built around lwIP's MQTT client can run the vulnerable code with lwIP never appearing on an equipment list or purchase order, the same blind spot that follows Espressif's newest microcontroller the moment a customer solders it into a product line without documenting the networking stack underneath.
The fix, and what CISA is not saying
lwIP shipped its fix as commit f89407ea711879c04d91c92b35d67be78bbaf0f1 on its Savannah repository, according to CISA's advisory, rather than in a numbered point release; the MQTT client's version scheme does not map to a single downloadable build the way a desktop application's does. CISA said it is not aware of the vulnerability being exploited, and it has published no list of the products or vendors that bundle the affected client. That silence matches how CISA handled its Sept. 24 addition of WSO2 and Adobe Commerce bugs to its separate Known Exploited Vulnerabilities catalog: a technical fix with no accompanying count of how many deployments remain exposed.
| CVSS 3.1 | CVSS 4.0 | CWE | Affected versions |
|---|---|---|---|
| 9.8 | 9.3 | CWE-787, out-of-bounds write | 2.0.1 through 2.2.1 |
Operators running lwIP's MQTT client have no version number to check against a vendor changelog. The only way to confirm a device is fixed is to compare its deployed source tree against the commit CISA named, a step that assumes whoever built the device kept a record of which lwIP revision they started from.
Sources
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.