Security readout for executives and security teams
Plain-English summary
CVE-2020-10063 can let a remote attacker crash or disrupt devices that use Zephyr RTOS to parse CoAP traffic. The issue is an integer overflow in CoAP option parsing. The known impact is denial of service, not data theft or code execution, but exposed embedded products could lose availability.
Executive priority
Handle as a moderate availability risk. It is not currently sourced as actively exploited, but exposed Zephyr-based devices using CoAP should be reviewed and updated through normal firmware security channels, especially in production, industrial, healthcare, or customer-facing deployments.
Technical view
The vulnerability is CWE-190 in Zephyr's CoAP option parsing. A remote unauthenticated adversary able to send arbitrary CoAP packets to affected Zephyr code can trigger denial of service. The CVSS 3.1 vector is 6.8 medium: network reachable, high complexity, no privileges, no user interaction, availability high, confidentiality and integrity unaffected.
Likely exposure
Exposure is most likely in embedded, IoT, or operational devices running affected Zephyr versions with CoAP parsing enabled and reachable over a network. The bundle names zephyrproject-rtos Zephyr and versions 2.2.0, 2.1.0, and 1.14.0, while the description also says 2.2.0 and later; treat version scope as needing vendor confirmation.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires the attacker to send crafted CoAP packets to Zephyr's parser, with CVSS marking attack complexity high. Practical risk rises where CoAP services are exposed across untrusted networks or crash recovery affects safety, service continuity, or fleet operations.
Researcher notes
The bundle provides the vulnerability class, impact, CVSS vector, affected project, and Zephyr references, but does not include detailed patch text or a definitive fixed version. Researchers should use the Zephyr security page and linked pull requests to confirm affected branches, fix commits, and any downstream vendor backports.
Mitigation direction
- Check Zephyr's advisory and linked PRs for the confirmed fixed release or backport.
- Upgrade affected Zephyr-based firmware following vendor or product maintainer guidance.
- Disable CoAP functionality where it is not required.
- Restrict CoAP reachability to trusted networks and expected peers.
- Prioritize devices where availability loss has operational or safety impact.
Validation and detection
- Inventory products and firmware builds that include Zephyr RTOS.
- Confirm whether the build enables Zephyr CoAP parsing code.
- Map network paths where untrusted systems can send CoAP traffic.
- Compare firmware branches against Zephyr advisory guidance and linked fixes.
- Review device logs for unexplained crashes or watchdog resets near CoAP traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-10063 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H2.24Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-55CVE reference · x_refsource_MISC
- https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10063CVE reference · x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/24435CVE reference · x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/24531CVE reference · x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/24535CVE reference · x_refsource_MISC
- https://github.com/zephyrproject-rtos/zephyr/pull/24530CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.