CISA 2026-09-22

lwIP TCP/IP Stack MQTT Client Application

CVE-2026-87121

Machine-generated analysis · WAYSCloud LLM

lwIP MQTT Client Application versions 2.0.1 through 2.2.1 are vulnerable to an out-of-bounds write.

Context

The advisory concerns the lwIP TCP/IP Stack MQTT Client Application. Versions 2.0.1 to 2.2.1 contain an out-of-bounds write that may allow full code execution on the device. The vulnerability is assigned CVSS 9.8 and is listed as CVE-2026-87121. The fix is provided in the lwIP repository as commit f89407ea711879c04d91c92b35d67be78bbaf0f1.

Operator considerations

Check: Verify the installed lwIP MQTT Client Application version is between 2.0.1 and 2.2.1.
Patch: Update to a version that includes commit f89407ea711879c04d91c92b35d67be78bbaf0f1 from the lwIP repository.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device.

The following versions of lwIP TCP/IP Stack MQTT Client Application are affected:

MQTT Client Application >=2.0.1|=2.0.1|

Read the full advisory on CISA →