Savannah lwIP SMTP client: 1 CVE, Critical 9.8
Summary
CISA reports 1 vulnerability in Savannah lwIP SMTP client. Weakness type: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Savannah
- Products
- lwIP SMTP client
- CVEs
- CVE-2026-15340
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- Sweden
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-15340 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 9.8 | – | No | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. |
Affected products (1)
- Savannah lwIP SMTP client: 2.2.1
Vendor fixes and mitigations (from advisory)
- Mitigation: xchglabs reports that the vulnerability was fixed and released in the following patch: patch_125_smtp_txbuf.diff . This is available as available as git commit (614420f82c8729d070e01464c0dddb3c9525c772)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.