What’s Vulnerable › Vulnerabilities

CVE-2020-10023: Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-11 · updated 2026-06-17
• Weakness: CWE-120

Description

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or possibly code execution within the Zephyr kernel. See NCC-NCC-019 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.

Affected products

• zephyrproject zephyr: 1.14.1, 2.1.0

References

• https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10023
• https://github.com/zephyrproject-rtos/zephyr/pull/23304
• https://github.com/zephyrproject-rtos/zephyr/pull/23646
• https://github.com/zephyrproject-rtos/zephyr/pull/23649
• https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-29
• https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10023
• https://github.com/zephyrproject-rtos/zephyr/pull/23304
• https://github.com/zephyrproject-rtos/zephyr/pull/23646
• https://github.com/zephyrproject-rtos/zephyr/pull/23649
• https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-29

Get alerted when CVE-2020-10023 or the next vulnerability affects your stack