CVE-2020-10028 - CVE House
Back to Database
Status published High CVE-2020-10028

Multiple Syscalls In GPIO Subsystem Performs No Argument Validation

Vulnerability Description

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10028

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • NCC Group for report

References

More from zephyrproject-rtos

View All →
CVE-2025-9558
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start
High 7.6
CVE-2025-9557
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
High 7.6
CVE-2025-9408
Userspace privilege escalation vulnerability on Cortex M
High 8.2
CVE-2025-7403
Bluetooth: bt_conn_tx_processor unsafe handling
High 7.6
CVE-2025-2962
Infinite loop in dns_copy_qname
High 8.2

Affected Vendor

zephyrproject-rtos

View all reports →

Affected Software

zephyr
Vulnerable Versions:
1.14.0, 2.1.0

Timeline

Official Publish: May 11th, 2020
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact