T1L Ethernet driver…¶

Key facts

CVE-2026-10673 is a High (8.3) vulnerability: The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver…. This entry ships a detection-only PoC and a Docker test lab.


CVE	CVE-2026-10673
Severity	High (8.3)
Detection / prevention	—
PoC	poc.py
Source	2026/CVE-2026-10673/

Details¶

English | 한국어

Description¶

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and the write cursor scur advanced, with no check that scur + len stayed within the buffer. The number of chunks (up to 255, from the BUFSTS RCA field) and the per-chunk length are taken entirely from the frame data received off the wire; the cursor is only reset on a start-of-frame chunk. An attacker on the single-pair Ethernet segment can therefore send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory (up to roughly 14.8 KB in the worst case). This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution. The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-10673
Type	RCE
CVSS Score	8.3

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-10673/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-10673

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/zephyrproject-rtos/zephyr/commit/158df8d088316cdae20816fc07703892280b2acb
https://github.com/zephyrproject-rtos/zephyr/commit/c98321cbfef23c0e3bdf043ccf6b421067c8d508
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hm6v-4jh4-3qc4
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hm6v-4jh4-3qc4

Generated by PoC Generator on 2026-07-16T04:47:23.883891006

Frequently asked questions¶

What is CVE-2026-10673?¶

CVE-2026-10673 is a High (8.3) vulnerability: The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver…. This entry ships a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-10673?¶

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2026-10673?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.