CVE-2023-7060 is a high severity (CVSS 8.6) improper input validation flaw in Zephyr OS IP packet handling, which does not drop packets arriving on an external interface with a loopback source address or a source equal to the destination. Zephyr 3.5 and earlier are listed with no patched version.
What's affected
The Zephyr advisory GHSA-fjc8-223c-qgqr, published 15 March 2024, lists affected versions as 3.5 and earlier and patched versions as none at the time of reading. It rates the issue High.
The advisory says most routers drop such packets before they reach the device, but if one does not, Zephyr should drop any packet arriving on an external interface with source 127.0.0.1, or with a source address equal to the destination. It applies to IPv4 and IPv6 with TCP and UDP.
How to check if you're exposed
Confirm which Zephyr release you build against and whether your product uses the IP stack on an external interface.
cat $ZEPHYR_BASE/VERSION
grep -E "CONFIG_NET_IPV4|CONFIG_NET_IPV6|CONFIG_NET_TCP|CONFIG_NET_UDP" build/zephyr/.config
If the network stack is not enabled, the issue does not apply to your image.
What to do now
- Check the advisory and Zephyr releases for a fix, and update when one is available.
- Use a router or firewall in front of the device that drops packets with a loopback source address and packets whose source equals the destination.
- Do not rely on source IP address for access control inside your device firmware.
- Record which products use Zephyr networking in your inventory.
- Run your dependency manifests and images through the free in-browser scan at gold.safeguard.sh/scan, and use reachability analysis to see whether the affected code is actually used in your build.
Why it matters
The advisory explains that localhost-sourced packets can bypass host-side access control based on IP address, and refers to published research on this pattern. A device that trusts packets from 127.0.0.1 may treat an outside sender as if it were a local process.
The record tags CWE-20. The principle is old and simple. A packet claiming a loopback source address should never arrive from the wire. Network stacks need to enforce that, and applications should not treat source address as proof of identity.
Firmware and engineering software update slowly. Start with an inventory of what you run and where it connects. Network isolation buys time while you test and schedule updates, and it is usually the first measure vendors recommend. Give each exception an owner and a review date so the workaround does not become permanent.
Weakness class in the record: CWE-20 (Improper Input Validation).
Quick check
Does my router protect me?
The advisory says most routers drop these packets. That helps only if your device sits behind one and you know its behavior, so verify rather than assume.
What if we cannot patch quickly?
Reduce who and what can reach the device. Segment the network, restrict management access to a known host, and record the exception with an owner and a review date.
Sources
Last reviewed: 19 October 2026.
