Vendors › lwIP

lwIP security advisories

2 CISA ICS advisories for lwIP in the last tracking window, 0 flagged as relevant to oil & gas. Newest first.

High 8.8 ICSA-26-265-02 · Sep 22, 2026 · lwIP

lwIP (Lightweight IP)

CISA reports 1 vulnerability in lwIP API. Weakness type: Double Free. Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system. Highest CVSS v3 score: 8.8 (High), exploitable from an adjacent network.

What to do: Prioritize: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://cgit.git.savannah.gnu.org/cgit/lwip.git. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec.
Critical 9.8 ICSA-26-265-01 · Sep 22, 2026 · lwIP

lwIP TCP/IP Stack MQTT Client Application

CISA reports 1 vulnerability in lwIP MQTT Client Application. Weakness type: Out-of-bounds Write. Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.

What to do: Act now: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://savannah.nongnu.org/projects/lwip. The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1.