Live › vulnerability › CVE-2026-119053
lwIP versions 2.0.0 through 2.2.1, built with the SNMP agent enabled, copy too many bytes when handling fragmented SNMP requests. A remote attacker who knows the read community string can get adjacent receive-buffer or pool memory echoed back in responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Only devices or software built on lwIP 2.0.0 through 2.2.1 with the SNMP agent compiled in are exposed. The attacker must reach the SNMP port and know the read community string, so systems with SNMP disabled, or reachable only from trusted management networks, are much less exposed. Embedded firmware is the usual place this lives and may be hard to update.
No product ranges from the sources yet.
LWIP_SNMP enabled in the lwIP configuration)2.0.0 through 2.2.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
This page as .md · .json · in your agent: get_signal("CVE-2026-119053")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.