The HL7800 modem driver in Zephyr parses the network‑supplied +CGCONTRDP response, which contains address fields such as the local address, subnet mask, gateway, and DNS servers. The response is linearized into a 256‑byte stack buffer, and the lengths of each address field are derived from delimiter positions in that data and used directly as the length argument to strncpy() into a fixed 64‑byte stack buffer. Because the field lengths are calculated from attacker‑controlled input and are not bounded against the destination buffer, a single overlong field can cause strncpy() to write past the buffer, corrupt adjacent stack memory, and lead to a remote crash or potential control‑flow hijacking.

Zephyr Project firmware that includes the HL7800 cellular modem driver. Devices running any Zephyr build that incorporates the HL7800 driver without the commit a1cbced64181bc0bdf95e1fd7118f2bb70cf679b (i.e., versions before the patch) are vulnerable.

The CVSS score of 8.8 indicates moderate to high severity. The lack of EPSS data and the absence from the CISA KEV catalog do not diminish the risk; a rogue or spoofed base station can craft a malicious +CGCONTRDP response during normal network attach to trigger the overflow. No privileged device operations or user interaction are required, so the attack vector is purely network‑side. On targets without stack protection, the overflow could lead to control‑flow hijacking, so the vulnerability is considered potentially exploitable.