java-topology/whitepaper/outreach/zephyr.md

Zephyr RTOS — CWE-312 Disclosure Brief

2026-04-13 · Patches available — awaiting upstream merge

Finding

Two CWE-312 cleartext credential logging defects in Zephyr RTOS across the WiFi credentials shell and WiFi connection manager. Both patched. Patches ready for upstream review. Both defects expose WiFi passwords (PSK, SAE, EAP-TLS key passphrase) to console and log backends.

The Defects

zephyr-0001 (PATCHED — HIGH, CWE-312): subsys/net/lib/wifi_credentials/wifi_credentials_shell.c:49

// WiFi password printed verbatim via shell command "wifi cred list"
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
              ", password: \"%.*s\", password_len: %d",
              (int)creds.password_len, creds.password, creds.password_len);
// ...
// EAP-TLS private key passphrase also printed verbatim
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
              ", key_passwd: \"%.*s\", key_passwd_len: %d",
              creds.header.key_passwd_length, creds.header.key_passwd, ...);

print_network_info() retrieves stored WiFi credentials and prints the plaintext PSK/password unconditionally via shell_fprintf when the wifi cred list shell command runs. Fires for WPA2-PSK, WPA2-PSK-SHA256, SAE, and WPA-PSK security types. Additionally, for EAP-TLS enterprise mode, the private-key passphrase prints verbatim.

On embedded systems with serial console, UART shell, or RTT logging, any observer with console access sees live credentials.

zephyr-0002 (PATCHED — HIGH, CWE-312): subsys/net/l2/wifi/wifi_mgmt.c:396

// WiFi PSK and SAE password dumped as raw hex on every connection attempt
LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
if (params->sae_password) {
    LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
}

wifi_connect() dumps the WiFi PSK and SAE password as raw hex via LOG_HEXDUMP_DBG on every connection attempt. When CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification testing), the PSK appears in the Zephyr logging backend. On boards with RTT, UART, or flash logging backends, this exposes the network passphrase in cleartext to anyone with console or log access.

Impact

Zephyr RTOS runs on millions of IoT devices, smart home hardware, industrial controllers, and wearables. WiFi-enabled Zephyr boards (ESP32, nRF7002, etc.) store network credentials that protect access to local networks.

zephyr-0001 fires whenever a developer or operator runs wifi cred list from the Zephyr shell, which appears in documentation and tutorials as the standard way to verify stored credentials. The password prints to whatever transport backs the shell (serial, USB CDC, RTT, telnet).

zephyr-0002 fires on every WiFi connection attempt when debug logging activates. During WiFi bring-up on new hardware, developers routinely enable CONFIG_WIFI_LOG_LEVEL_DBG=y. On boards with persistent log backends (flash, network syslog), the PSK persists in cleartext storage.

Both defects affect enterprise deployments using EAP-TLS, where the private-key passphrase and WiFi credentials protect access to corporate networks.

The Fix

zephyr-0001: Replace password and key_passwd output with a redacted marker:

// Before
shell_fprintf(sh, ..., ", password: \"%.*s\", password_len: %d",
              (int)creds.password_len, creds.password, creds.password_len);

// After
static const char REDACTED[] = "[redacted]";
shell_fprintf(sh, ..., ", password: %s, password_len: %d",
              REDACTED, creds.password_len);

The password_len still prints so operators can verify a credential is set without exposing its value.

zephyr-0002: Remove LOG_HEXDUMP_DBG for PSK and SAE password, log only presence:

// Before
LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");

// After
LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
LOG_DBG("sae_password set: %s", (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");

Patch

Fixes available:

• defects/zephyr-0001/patch/zephyr-0001.patch
• defects/zephyr-0002/patch/zephyr-0002.patch

Two-file patch across wifi_credentials_shell.c and wifi_mgmt.c. Both patches replace credential output with redacted markers while preserving diagnostic length/presence information.

What We Ask

Patches ready for review.

1. Confirm receipt and assign a GitHub issue reference (zephyrproject-rtos/zephyr).
2. Assess severity — both defects expose WiFi credentials (PSK, SAE, EAP-TLS key passphrase) to serial console and log backends.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the Zephyr project in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.