The HL7800 cellular modem driver's response handler for the +CGCONTRDP AT command in Zephyr parses PDP-context parameters into fixed-size stack buffers without proper bounds checking. The length of each address field is derived from attacker-controlled delimiter positions and used directly as the length argument to strncpy(), allowing an overlong field to overflow the 64-byte temp_addr_str buffer and the 16-byte dns_v4_string buffer. This stack buffer overflow occurs in supervisor context on the modem worker thread and can be triggered remotely by a malicious or rogue cellular network during normal network attach procedures, without requiring any device privileges or user interaction. The vulnerability can cause a crash or potentially enable control-flow hijacking on systems lacking stack protection. The patch bounds each field length against its destination buffer size before copying, rejecting overlong fields.

A remote attacker controlling or impersonating the cellular network can trigger a stack buffer overflow on the device by sending a crafted +CGCONTRDP response. This can cause a denial of service (crash) or potentially allow remote code execution or control-flow hijacking on affected devices without requiring privileges or user interaction. The vulnerability impacts confidentiality, integrity, and availability (all rated high).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that bounds field lengths before copying to prevent overflow, but no official patch or remediation level is currently provided. Until a patch is available, devices should avoid connecting to untrusted cellular networks or use network authentication mechanisms to reduce exposure.