The IPv6 Neighbor Discovery (ND) handlers in Zephyr OS (subsys/net/ip/ipv6_nbr.c) contain a logic error in the boolean expression that combines RFC 4861 validity checks with the ICMPv6 code check. The expression used incorrect operator precedence, causing the entire predicate to evaluate false when the ICMPv6 code is 0, which is the normal and legitimate value for ND messages. Consequently, critical checks such as Hop Limit == 255, source address validation for Router Advertisements, and multicast-target sanity checks are bypassed. This flaw allows an adjacent on-link attacker, and potentially a remote attacker due to the bypassed Hop Limit check, to inject forged ND messages. These forged messages can reconfigure the victim's network parameters (default router, on-link prefixes, MTU, timers, DNS servers) and poison neighbor caches, enabling man-in-the-middle attacks, traffic redirection, and denial of service. The vulnerability has existed since the logic was introduced in 2018 and affects all releases up to but not including version 4.5.0. The issue is an input validation/authentication weakness rather than a memory safety problem. The fix involves splitting the condition so that any failing check results in packet drop. No official patch or remediation level is currently documented.

An attacker adjacent to the victim's network or potentially remote can send forged IPv6 Neighbor Discovery messages that bypass critical validation checks. This enables reconfiguration of network parameters such as default routers, on-link prefixes, MTU, timers, and DNS servers, as well as neighbor cache poisoning. The consequences include man-in-the-middle attacks, traffic redirection, and denial of service. The flaw does not cause memory corruption but compromises the integrity and authenticity of IPv6 Neighbor Discovery processing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider mitigating exposure by restricting access to the affected Zephyr devices from untrusted networks and monitoring for suspicious Neighbor Discovery traffic. Avoid relying solely on the affected ND validation in Zephyr for security-critical environments.