A stack-based buffer overflow vulnerability was found in oFono's AT modem Huawei network time notification handler. The function huawei_nwtime_notify() in drivers/atmodem/network-registration.c uses sscanf with an unbounded %s format specifier to parse a timezone string from the ^NWTIME: unsolicited AT notification into a 4-byte stack buffer tz[4]. The buffer is sized for a normal timezone offset like "+08" (3 chars + null = 4 bytes), but sscanf with %s reads all non-whitespace characters without any width limit.

A compromised Huawei modem baseband can send a ^NWTIME: notification with an arbitrarily long string after the time digits (e.g., "12:30:45+AAAA...100chars..."), causing sscanf to write up to ~4086 bytes past the end of the 4-byte tz buffer. This corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution.

The vulnerable handler is registered during network registration initialization when the vendor is OFONO_VENDOR_HUAWEI. Affected Huawei modem hardware includes USB dongles (E3372, E3531, E8372), embedded modules (ME909, MU709), mobile hotspots (E5573, E5577), and CPE routers (B310, B315, B525). No user interaction is required — ^NWTIME: is an unsolicited notification that the modem can send at any time after network registration. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.