Critical Buffer Overflow (CVE‑2026‑15340) in Savannah lwIP SMTP Client Enables Remote Code Execution
What It Is – The Savannah lwIP SMTP client version 2.2.1 contains a classic buffer‑overflow (CWE‑120) that fails to validate input size. Successful exploitation can crash the device or allow an attacker to execute arbitrary code remotely.
Exploitability – CVSS 3.1 base score 9.8 (Critical). The vulnerability is network‑accessible, requires no authentication, and has a low attack complexity. Public proof‑of‑concept code has been observed.
Affected Products – Savannah lwIP SMTP client 2.2.1 (CVE‑2026‑15340).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture third‑party component versions and patch status.
- Provides evidence that a robust patch‑management process is in place, supporting audit‑ready documentation of due‑diligence.
- Highlights the importance of secure configuration monitoring to assure that critical infrastructure devices remain within an acceptable risk posture.
Recommended Actions
- Apply the vendor‑provided patch
patch_125_smtp_txbuf.diff(git commit 614420f82c8729d070e01464c0dddb3c9525c772) to all affected devices. - Verify the running version via inventory scans and confirm remediation in your asset‑management system.
- Update your vulnerability‑management policy to include automated detection of lwIP library versions in firmware.
- Document the remediation steps and retain patch artifacts as part of your audit evidence.
Source: CISA Advisory – ICSA‑26‑279‑02