Preface: IoT manufacturers are very willing to use lwIP (Lightweight IP) in firmware, and it is widely used in commercial IoT products. It is a dominant TCP/IP stack in the embedded space because it provides a full-featured networking stack (TCP, UDP, DHCP, DNS) while being highly optimized for resource-constrained, low-power devices.

Even though firmware allocate an lwIP pbuf to hold the payload in RAM

[// PBUF_TRANSPORT automatically reserves space for UDP/IP headers]

If your firmware explicitly uses SNMPv3 alongside your Wake-on-LAN feature, you must apply the patch.

Background: Inbound parsing and outbound allocation are two completely different memory directions (see below):

Outbound – When you call pbuf_alloc(PBUF_TRANSPORT, …), you are allocating memory for an outgoing packet. This works perfectly and securely for transmitting your Magic Packet.

Inbound – When an SNMPv3 management command comes into your device, lwIP allocates an incoming pbuf automatically to hold the raw network packet. The vulnerability happens after allocation, during the parsing phase inside snmp_msg[.]c.

Why CVE-2026-8836 Bypasses Pbuf Protection

The flaw is a stack-based buffer overflow, not a pbuf heap overflow.

i.When a remote user sends an SNMPv3 packet, the function snmp_parse_inbound_frame sets up a fixed-size array on the CPU stack called request->msg_authentication_parameters. This buffer is hardcoded to a maximum size of SNMP_V3_MAX_AUTH_PARAM_LENGTH (usually 32 bytes).

ii.The unpatched code uses the variable tlv.value_len (which comes directly from the untrusted incoming packet header) to decide how many bytes to decode into that stack array.

iii.An attacker can craft a malicious SNMPv3 packet stating that the authentication data is 100 bytes long. Because the check was commented out (/* IF_PARSE_ASSERT(…) */), lwIP blindly executes snmp_asn1_dec_raw and writes all 100 bytes into the 32-byte stack buffer, smashing the CPU stack, corrupting the return address, and crashing your chip or allowing remote code execution.

Vulnerability details: A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely.

Remedy: The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.

Official announcement: Please refer to link for details –

https://nvd.nist.gov/vuln/detail/CVE-2026-8836

Preface: Qualcomm chipsets contain Powerline Communication (PLC) firmware features, particularly within their automotive and IoT-focused product lines designed for smart grid and electric vehicle (EV) charging.

Background: To implement write protection for SPI Flash, you generally need a combination of Hardware WP# pins and Software Status Register configurations.

The SPI Flash physical and software protection bits (BP bits / WP# pin) failed to provide a complete write-lock across the device lifecycle.

The threat model for CVE-2026-25293 usually assumes an attacker targets the PIB (Parameter Information Block):

•       Malicious PIB Modification: If WP is not active, an attacker can change MAC addresses or security keys in the PIB to conduct Man-in-the-Middle (MITM) attacks and steal charging credentials.

•       Persistent Backdoor: By overwriting sections of the NVM code (made possible because BP bits = 0), an attacker can implant a persistent backdoor that survives a reboot.

Vulnerability Details:

Title – Incorrect authorization in PLC FW

Description – Buffer overflow due to incorrect authorization in PLC FW

Technology Area – PLC FW

Vulnerability Type – CWE-863

Access Vector – Remote

Security Rating – Critical

Official announcement: Please refer to the link for details – https://docs.qualcomm.com/securitybulletin/may-2026-bulletin.html

Remedy: The primary remedy is to update the affected PLC firmware to the latest version supplied by the vendor that specifically addresses this CVE.

Preface: Even though QSC is installed on your Windows or Linux PC, its primary mission is to manage the Linux operating system that lives on your Target Development Board. QSC v1.21.0 knows exactly how to handle projects based on “Long Term Support Kernels” and provides the specific tools and patches required for them.

Background: To enable this within your qsc-cli workspace, follow these steps to modify your build configuration:

Step 1. Log in to the CLI
bash

qsc-cli login -u <your_email_address>

Step 2. In the context of the Qualcomm QRB4210 (RB2) and the Qualcomm Linux SDK, “enabling the SocketIO interface” typically refers to configuring a high-speed communication transport layer used in the Robot Operating System (ROS) or for high-speed sensor data between subsystems.

To enable this within your qsc-cli workspace, follow these steps to modify your build configuration:

Step 3. Identify the Required Metadata Layer

Socket-based transport optimizations, such as QRB ROS transport for zero-copy message passing, are often contained in the Qualcomm Intelligent Robotics (QIRP) SDK layers. Ensure you have the meta-qcom-qirp (or similar) layer in your workspace

Step 4. Update your bblayers.conf

Step 5. Enable via Kernel Menuconfig (If Hardware Socket/Interface)

If you are referring to a specific hardware-backed socket interface (like a virtualized socket for a DSP or NPU), you may need to enable it in the kernel:

Enter your build environment via qsc-cli.

Run the devtool to modify the kernel configuration:

Bash

devtool menuconfig linux-qcom-base

Search (using /) for SOCKET or the specific interface driver name (e.g., AF_QIPCRTR for Qualcomm IPC Router sockets).

Set it to <*>

Vulnerability details: Improper authorization in Qualcomm Software Center

Description : Improper authorization leads to Remote Code Execution via SocketIO interface.

Official announcement: Please refer to the link for details –

https://docs.qualcomm.com/securitybulletin/may-2026-bulletin.html