Vulnerabilities in STM32Cube middleware: lwIP, mbedTLS, FreeRTOS

Which middleware versions does ST ship in STM32Cube?

Besides HAL and CMSIS, an STM32Cube package brings libraries from other vendors. Their versions are in the headers and in the file st_readme.txt of each middleware, where ST records every update. Read at the tags on GitHub, as of 23 October 2026. The packages for F4, F7 and H7 build on FreeRTOS and lwIP, the newer ones for U5 and H5 on ThreadX with NetX Duo.

$ ls Middlewares/Third_Party

FatFs
FreeRTOS
LibJPEG
LwIP
mbedTLS

$ grep -E "#define LWIP_VERSION_(MAJOR|MINOR|REVISION)"  \
LwIP/src/include/lwip/init.h

#define LWIP_VERSION_MAJOR      2
#define LWIP_VERSION_MINOR      1
#define LWIP_VERSION_REVISION   2

$ grep "MBEDTLS_VERSION_STRING " mbedTLS/include/mbedtls/version.h

#define MBEDTLS_VERSION_STRING         "2.16.2"

$ grep -n "### 15-March-2019\|Upgrade to use LwIP V2.1.2" LwIP/st_readme.txt

54:### 15-March-2019 ###
56:  + Upgrade to use LwIP V2.1.2 version

STM32CubeH7: What do the Git tag and the release notes say?

For some versions now, ST has included the middleware as Git submodules. For STM32CubeH7 v1.13.0 of 24 February 2026, the release notes and the SBOM file sbom_cdx.json name FreeRTOS V10.6.2 and lwIP 2.2.1. The submodule at Git tag v1.13.0, however, points to the ST tags v10.3.1_20200831 and v2.1.2_20190315. Anyone who fetches the package at the tag with git clone --recurse-submodules builds lwIP 2.1.2 with CVE-2020-22283 and CVE-2020-22284, and FreeRTOS 10.3.1 with three CVSS 9.8 vulnerabilities.

Only a commit on the master branch of 27 March 2026 moves the submodules to the newer states. What counts is the state in the project.

$ git ls-tree v1.13.0 Middlewares/Third_Party/ | grep -E "LwIP|FreeRTOS"

160000commit 5fe3a380e5eadb6ce0a5149725210c3fe70d1c15	Middlewares/Third_Party/FreeRTOS160000commit f0d19c3a6e7420248775b5163b8dbf1fc2371331	Middlewares/Third_Party/LwIP

$ git ls-tree master Middlewares/Third_Party/ | grep -E "LwIP|FreeRTOS"

160000commit e41c220a37adbb55b59dca704def6e73d6258b95	Middlewares/Third_Party/FreeRTOS160000commit 07680c8172fa5fc135adefa3f7711c14f4938dc9	Middlewares/Third_Party/LwIP

What has ST published on the lwIP CVEs?

In security advisory SA0037 of 9 April 2025, ST names the lwIP vulnerabilities CVE-2020-22283 and CVE-2020-22284 as relevant for STM32CubeF1, F2, F4, F7 and H7, for F4 up to v1.28.1. Affected is lwIP 2.1.2 and earlier, fixed from 2.1.3. ST provides the fix in a repository of its own; the device manufacturer has to build it in.

ST adds: “Because the issue might not be fixed in subsequent version, refer to the release notes of the affected product to check if the issue has been fixed.” The newer F4 package v1.28.3 still contains lwIP 2.1.2, and the line that ST's fix changes is unchanged in it:

The five lwIP CVEs from 2026 (SNMPv3, MQTT, SMTP, mDNS, API) affect 2.1.2 and 2.2.1 as well, according to the CNA. On 23 October 2026 their fixes exist only on lwIP's master branch, in none of the ST copies checked: F4, F7 and H7 at the tag and on master, there ST tag v2.2.1_20250804.

$ curl -s https://raw.githubusercontent.com/STMicroelectronics/stm32-mw-lwip/v2.1.3_20230818/src/netif/zepif.c  \
| diff LwIP/src/netif/zepif.c -

204c204
<   err = pbuf_take_at(q, p->payload, p->tot_len, sizeof(struct zep_hdr));
---
>   err = pbuf_copy_partial_pbuf(q, p, p->tot_len, sizeof(struct zep_hdr));

Which CVEs does each component have?

The NVD count per version, checked on 23 October 2026, with the highest-rated vulnerabilities. None of them is in the CISA catalogue of actively exploited vulnerabilities. Whether a vulnerability can be exploited in the device depends on whether the affected function is built and reachable.

Has ST changed ThreadX and NetX Duo since 6.4.0?

In U5 v1.9.0 and H5 v1.7.0, ST ships ThreadX, NetX Duo, USBX and FileX in version 6.4.0, which ST took over on 19 April 2024. Eclipse has released up to 6.5.2 since then, for NetX Duo most recently on 13 October 2026. The st_readme.txt of the NetX Duo copy names no security fix since the upgrade to 6.4.0; its entries concern drivers, documentation and the list of licensed parts. The FileX copy notes on 11 August 2025: “SA0038 issue is fixed”.

For a device with a DHCPv6 client or a TLS server from NetX Duo this means: check the code of the copy. The version and st_readme.txt name no fix for the two vulnerabilities with CVSS 9.0 or higher.

What does ST say about mbedTLS in SB0033?

ST does not publish a CVE list of its own for mbedTLS. Bulletin SB0033 says that the security advisories of TrustedFirmware.org apply to the STM32Cube packages with mbedTLS, and names as the remedy: reconfigure the package with a fixed mbedTLS version from the mbedTLS website. Which version is in the package is again in st_readme.txt.

For the packages with 2.16.2 there is no fixed version of the same line. 2.16.12 of 17 December 2021 was the last release; the path leads to 3.6.

How do I find out which version my device carries?

1. 1

   Determine the package version

   the line ProjectManager.FirmwarePackage in the .ioc file.

2. 2

   Read the middleware versions

   headers and st_readme.txt of each library in the project. For a clone from GitHub, also git submodule status, because the state can differ from the release notes.

3. 3

   Check what is linked

   the symbol table of the ELF or AXF. A library that leaves no function in the image is not in the device.

4. 4

   Check the configuration

   IPv6, 6LoWPAN, DTLS, SNMPv3, MQTT, DHCPv6 and other options decide whether a vulnerability is built at all.

5. 5

   Build in the fix

   take over the fixed library, even if the Cube package itself still carries the old version.

What can I do?

1. 1

   lwIP 2.1.2: move to ST tag v2.1.3_20241213 or newer in the repository stm32-mw-lwip; that fixes CVE-2020-22283 and CVE-2020-22284. For SNMPv3, MQTT, SMTP and mDNS, take over the commits from lwIP's master branch.

2. 2

   mbedTLS 2.16.2: move to 3.6.7. In U5 and H5 from 3.6.6 to 3.6.7.

3. 3

   FreeRTOS V10.2.1 and V10.3.1: move to at least 10.4.3. ST offers the states v10.6.2 and v11.2.0 in the repository stm32-mw-freertos.

4. 4

   NetX Duo, ThreadX, FileX and USBX 6.4.0: build in the current Eclipse ThreadX version or take over the fixes one by one.

5. 5

   Check the CISA KEV catalogue for actively exploited vulnerabilities.

Can this run automatically?

LegacyMind reads the built-in libraries with their versions from the ELF or AXF of your build, for example lwIP, mbedTLS and FreeRTOS from STM32Cube, and matches them against the public vulnerability sources, with a note on whether a vulnerability is actively exploited. If the file evidences no version, the field stays blank.