The vulnerability resides in the Zephyr RTOS IPv6 Neighbor Discovery handlers, where a Boolean expression incorrectly merges RFC 4861 validity checks with an ICMPv6 code comparison. Because every legitimate ND message carries code 0, the expression evaluates to false and bypasses mandatory checks such as hop-limit 255 and source-address validation. As a result, crafted Router Advertisements, Neighbor Solicitations, and Neighbor Advertisements are accepted without proper authentication. An attacker can thus reconfigure the victim’s default router, on-link prefixes, MTU, timers, and, with DNS-server reconfiguration enabled, alter DNS resolution. Fabricated NS/NA messages can poison the neighbor cache, enabling man-in-the-middle attacks, traffic diversion, and denial-of-service.

Affected systems are all Zephyr RTOS releases up to and including version 4.4.0, where the flawed logic was first introduced in 2018 and remained uncorrected. The defect is present in the IPv6 Neighbor Discovery implementation located in subsys/net/ip/ipv6_nbr.c.

The risk is high: the CVSS score is 8.1, and the exploit does not depend on memory corruption or privilege escalation. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. An attacker only needs the ability to generate crafted ICMPv6 packets and can exploit the flaw from an adjacent on-link host; because the hop-limit check is bypassed, a remote off-link attacker can also succeed by spoofing packets. The attack is a network-level privilege escalation that compromises confidentiality, integrity, and availability of the target device and potentially the network segment it serves.