‹ Back to ICS Advisories

lwIP TCP/IP Stack MQTT Client Application

CRITICAL

CVSS 9.8

Date 2026-09-22T06:00:00+00:00

Source cisa-csaf

Published by CISA

// Description

Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device.

// Vulnerabilities (1)

CVE ID	CVSS Score	Severity	Description
CVE-2026-87121	9.8	critical	The affected product is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

// Remediations (1)

Mitigation: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://s

Users of lwIP are encouraged to update their version of lwIP using the repository found at https://savannah.nongnu.org/projects/lwip. The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1.

// References

CISA ICSA-26-265-01
CISA https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-265-01.json
CISA https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01
CISA https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
CISA https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CISA https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
CISA https://www.cisa.gov/topics/industrial-control-systems
CISA https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
CISA https://www.cisa.gov/uscert/ncas/tips/ST04-014
CISA https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
CISA https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
CISA https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
CISA https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
CISA https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks