AIKIDO-2026-447954

TL;DR

The UpdateHub firmware-update agent parses JSON metadata returned by the update server into a fixed two-level nested array and validates only the outer array length before dereferencing the inner sha256sum pointer. The metadata is fetched over CoAP from the configured UpdateHub server, so a malicious or compromised server, or an on-path party when DTLS is disabled, can return a response whose inner object array is empty. The zero-initialized parse target leaves the sha256sum pointer NULL, and the following strlen() dereferences address zero and faults the device. The fix rejects metadata whose inner object array is empty before any dereference on both metadata layouts.