CVE-2020-10059

MEDIUM

Zephyr 2.1.0 and later - Improper Certificate Validation in UpdateHub Module

Title source: llm
STIX 2.1

Description

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.

References (5)

Core 5
Core References
Third Party Advisory x_refsource_misc
https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-36
Patch, Third Party Advisory x_refsource_misc
https://github.com/zephyrproject-rtos/zephyr/pull/24954
Patch, Third Party Advisory x_refsource_misc
https://github.com/zephyrproject-rtos/zephyr/pull/24999
Patch, Third Party Advisory x_refsource_misc
https://github.com/zephyrproject-rtos/zephyr/pull/24997

Scores

CVSS v3 4.8
EPSS 0.0118
EPSS Percentile 63.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Details

CWE
CWE-295
Status published
Products (2)
zephyrproject/zephyr 2.1.0
zephyrproject/zephyr 2.2.0
Published May 11, 2020
Tracked Since Feb 18, 2026