Zephyr RTOS’s IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c use an incorrect Boolean expression that combines RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence. The expression ((length/hop/source/target checks) && (icmp_hdr->code != 0)) incorrectly treats every legitimate ND packet – which carries ICMPv6 code 0 – as passing, causing all other mandatory checks (Hop Limit == 255, source link‑local verification for Router Advertisements, multicast‑target sanity checks) to be silently skipped. The result is that an adjacent on‑link attacker, and because the Hop‑Limit‑255 guard is bypassed, potentially a remote or off‑link attacker can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA can reconfigure the victim’s default router, on‑link prefixes, MTU, reachable/retransmit timers, and even DNS servers if CONFIG_NET_IPV6_RA_RDNSS is enabled, while forged NS/NA messages can poison the neighbor cache, enabling man‑in‑the‑middle attacks, traffic redirection, and denial of service. This flaw is an input‑validation/authentication weakness; the underlying packet parsing primitives are bounds‑safe, so no out‑of‑bounds access occurs.

All Zephyr RTOS releases up to and including v4.4.0 are affected. The buggy logic was introduced in 2018 and remained unchanged through v4.4.0; later releases contain the fix.

The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker must be able to craft ICMPv6 packets that conform to the ND format. Based on the description, it is inferred that an adjacent on‑link host can exploit the vulnerability directly, and that a remote or off‑link attacker might succeed because the hop‑limit guard is bypassed, allowing spoofed packets that would otherwise be rejected. The exploit does not involve memory corruption or privilege escalation but compromises confidentiality, integrity, and availability of the target device and potentially the wider network segment.