Description

The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-byte stack buffer, after which each address field length is computed from comma/. delimiter positions in the network-supplied data and used directly as the length argument to strncpy() into the fixed 64-byte stack buffer temp_addr_str (and the 16-byte iface_ctx.dns_v4_string). Because the field length is derived from attacker-controlled delimiter positions and was not bounded against the destination buffer, a single field can be far larger than 64 bytes. A malicious or impersonated cellular network (for example a rogue base station) can return a crafted +CGCONTRDP response with an overlong address field, causing strncpy() to write past temp_addr_str on the modem worker thread's stack, plus an out-of-bounds NUL write at temp_addr_str[addr_len]. No device-side privileges or user interaction are required: the device itself issues the AT+CGCONTRDP=1 query during normal network attach and parses whatever the network returns. The overflow corrupts adjacent stack memory in supervisor context, yielding at minimum a remotely triggerable crash and potentially control-flow hijacking on targets without stack protection. The fix bounds every field length against its destination buffer (temp_addr_str and dns_v4_string) before each copy, rejecting overlong fields.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T21:16:53.507Z",
  "pubdate": "2026-08-19T21:16:53.507Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in the HL7800 cellular modem driver, specifically within the +CGCONTRDP response handler on_cmd_atcmdinfo_ipaddr() located in drivers/modem/vendor_standalone/hl7800.c.\nThe vulnerability allows a malicious or impersonated cellular network, such as a rogue base station, to achieve memory corruption on the modem worker thread's stack in supervisor context.\nThe primary impact includes a remotely triggerable device crash (denial of service) and potential control-flow hijacking on target systems lacking robust stack protection mechanisms.\nNo device-side privileges or user interaction are required for exploitation, as the device automatically issues the AT+CGCONTRDP=1 query during standard network attachment procedures and blindly parses the returned data.\nThe risk implication is severe due to the remote, unauthenticated nature of cellular network interactions, where compromised or hostile base stations can directly target connected IoT or embedded devices utilizing the HL7800 modem driver.",
  "technicalDetails": "The vulnerable component is the on_cmd_atcmdinfo_ipaddr() response handler function within the HL7800 cellular modem driver, implemented in the source file drivers/modem/vendor_standalone/hl7800.c.\nThe root cause of the vulnerability stems from unsafe parsing and copying of PDP-context dynamic parameters—including local addresses, subnet masks, gateways, and DNS servers—assigned by the cellular network.\nDuring normal operation, the device issues an AT+CGCONTRDP=1 query to retrieve network configuration parameters. The response is linearized into an intermediate 256-byte stack buffer.\nSubsequently, the driver computes each address field length dynamically based on comma and period delimiter positions present within the network-supplied data string.\nThese computed length values are passed directly as the length arguments to strncpy() operations targeting a fixed 64-byte stack buffer named temp_addr_str, as well as a 16-byte iface_ctx.dns_v4_string buffer.\nBecause the field lengths are derived entirely from attacker-controlled delimiter positions without validation or bounding against the actual sizes of the destination buffers, a specially crafted response containing an overlong address field will exceed the 64-byte allocation of temp_addr_str.\nStep-by-step attack flow: First, a malicious cellular network or rogue base station waits for the device to attach and issue the AT+CGCONTRDP=1 query. Second, the adversary responds with a crafted +CGCONTRDP response containing maliciously oversized address fields defined by manipulated delimiter offsets. Third, the driver parses the response into the 256-byte stack buffer and calculates inflated field lengths. Fourth, the insecure strncpy() invocation copies the excessive data past the boundaries of temp_addr_str on the modem worker thread's stack. Finally, an out-of-bounds NUL byte is written at temp_addr_str[addr_len], resulting in adjacent stack memory corruption in supervisor context.\nThe exploitation vector requires no authentication, zero user interaction, and leverages standard network exposure during the cellular attach sequence to achieve arbitrary stack overwrites."
}