Buffer Overflow Vulnerability in HL7800 Cellular Modem Driver by Vendor Standalone

CVE-2026-12522

What is CVE-2026-12522?

The HL7800 cellular modem driver contains a vulnerability in the response handling of the +CGCONTRDP command. The flaw arises when parsing PDP-context parameters like IP addresses and DNS servers, specifically due to insufficient bounds checking on the lengths of these parameters. An attacker can exploit this vulnerability by supplying malicious data through a compromised or rogue cellular network, allowing for crafting of responses that exceed expected lengths. This can lead to buffer overflow conditions in the stack, resulting in potential crashes or more severe control-flow hijacking scenarios without requiring user interaction or elevated privileges. The fix implemented bounds the length of each field against the size of the destination buffers to prevent such overflow issues.

References