CVE-2026-12522: HL7800 Modem Driver Buffer Overflow Flaw

CVE-2026-12522 Overview

CVE-2026-12522 is a stack-based buffer overflow [CWE-787] in the Zephyr RTOS HL7800 cellular modem driver. The vulnerability resides in the on_cmd_atcmdinfo_ipaddr() handler in drivers/modem/vendor_standalone/hl7800.c, which parses +CGCONTRDP: responses from the cellular network. Field lengths are derived from attacker-controlled delimiter positions and passed unchecked to strncpy() targeting a 64-byte stack buffer. A rogue base station can trigger the overflow during normal PDP-context attach, requiring no user interaction and no device-side privileges.

Critical Impact
A malicious or impersonated cellular network can corrupt supervisor-context stack memory on the modem worker thread, causing device crashes and potentially hijacking control flow on targets without stack protection.

Affected Products

Zephyr RTOS HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c)
Devices integrating the Sierra Wireless HL7800 modem via the Zephyr standalone driver
Zephyr-based firmware images shipped before commit a1cbced64181bc0bdf95e1fd7118f2bb70cf679b

Discovery Timeline

2026-08-19 - CVE-2026-12522 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-12522

Vulnerability Analysis

The HL7800 driver issues AT+CGCONTRDP=1 during network attach to retrieve PDP-context dynamic parameters, including the local IPv4 address, subnet mask, gateway, and DNS servers. The response is linearized into a 256-byte stack buffer for parsing. Each address field length is then computed from the offsets between comma and period delimiters in the network-supplied string.

Those computed lengths flow directly into strncpy() calls that write into the fixed 64-byte temp_addr_str buffer and the 16-byte iface_ctx.dns_v4_string buffer. No bounds check compares the field length against the destination size. An overlong field also causes an out-of-bounds NUL byte write at temp_addr_str[addr_len].

The modem worker thread runs in supervisor context on Zephyr, so corrupted stack frames can undermine kernel-mode execution. On builds without stack canaries or MPU-enforced stack protection, the overflow is a plausible path to control-flow hijacking.

Root Cause

The root cause is missing input validation on network-supplied delimiter positions. The driver trusted the cellular network to return conformant IP address strings and used the computed offsets as copy lengths without bounding them against destination buffers.

Attack Vector

Exploitation requires adjacent-network access via a rogue or impersonated LTE base station. The attacker responds to the device's AT+CGCONTRDP=1 query with a crafted +CGCONTRDP: payload containing an overlong address, mask, gateway, or DNS field. The device parses attacker data during normal attach without any user interaction.

 
 	/* get new IP addr */
 	addr_len = sm_start - addr_start;
+	/* addr_len is derived from delimiter positions in the network-supplied
+	 * response and must not exceed the fixed temp_addr_str buffer.
+	 */
+	if (addr_len >= sizeof(temp_addr_str)) {
+		LOG_ERR("IP addr too long");
+		return true;
+	}
 	strncpy(temp_addr_str, addr_start, addr_len);
 	temp_addr_str[addr_len] = 0;
 	LOG_DBG("IP addr: %s", temp_addr_str);

Source: Zephyr commit a1cbced. The patch bounds addr_len against sizeof(temp_addr_str) before every strncpy() and returns early on overlong fields.

Detection Methods for CVE-2026-12522

Indicators of Compromise

Unexpected modem worker thread crashes, kernel panics, or watchdog resets shortly after cellular attach or PDP-context activation
Malformed +CGCONTRDP: responses in modem AT trace logs containing address fields longer than typical IPv4 dotted-quad or IPv6 representations
Repeated attach cycles against unknown or unauthorized base stations in areas where no legitimate cell towers are expected

Detection Strategies

Enable Zephyr modem debug logging (LOG_DBG) to capture raw +CGCONTRDP: responses and flag fields exceeding 64 bytes
Monitor firmware crash telemetry for stack corruption signatures originating in on_cmd_atcmdinfo_ipaddr() frames
Correlate device attach failures with RF environment scans to identify rogue base station activity

Monitoring Recommendations

Ingest device crash dumps and modem AT logs into a central log platform for anomaly review
Alert on repeated PLMN or cell-ID changes to towers not present in the operator's expected list
Track firmware version rollout to confirm all fielded devices run patched builds

How to Mitigate CVE-2026-12522

Immediate Actions Required

Update Zephyr source trees to a build that includes commit a1cbced64181bc0bdf95e1fd7118f2bb70cf679b and rebuild firmware for all HL7800-equipped devices
Plan an over-the-air or field firmware update for deployed devices that use the standalone HL7800 driver
Enable stack protection features (CONFIG_STACK_CANARIES, MPU-based stack guards) in Zephyr builds where hardware supports them

Patch Information

The fix is available in the Zephyr Project upstream repository. See the Zephyr commit details and the Zephyr GitHub Security Advisory GHSA-hchc-6489-w66v. The patch bounds every +CGCONTRDP: field length against its destination buffer (temp_addr_str and dns_v4_string) before each copy and rejects overlong fields.

Workarounds

Restrict devices to trusted PLMNs by configuring operator allowlists on the modem where the deployment allows
Where feasible, disable or restrict use of the standalone HL7800 driver in Zephyr builds until patched firmware is deployed
Physically deploy devices in RF environments with reduced exposure to unauthorized base stations

bash

# Rebuild Zephyr firmware including the CVE-2026-12522 fix
cd zephyrproject/zephyr
git fetch origin
git cherry-pick a1cbced64181bc0bdf95e1fd7118f2bb70cf679b
west build -b <board> samples/net/cellular_modem -- \
    -DCONFIG_MODEM_HL7800=y \
    -DCONFIG_STACK_CANARIES=y \
    -DCONFIG_HW_STACK_PROTECTION=y