What is the official website of CMC LTD ?

The official website of CMC LTD is https://http://www.cmcltd.com.

What is CMC LTD's cybersecurity risk score?

CMC LTD has an AI-generated cybersecurity risk score of 765 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has CMC LTD experienced?

According to Rankiteo, CMC LTD currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has CMC LTD been affected by any supply chain cyber incidents ?

According to Rankiteo, CMC LTD has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: Microsoft (Incident ID: HCLTAT1786448292) Tata Group (Incident ID: TATRED1782606562) Tata Group (Incident ID: MIC1773923106) Tata Group (Incident ID: MAR1193411110425) Cellebrite (Incident ID: DELOPETATAPPCELCOU1782491615)

Does CMC LTD have SOC 2 Type 1 certification ?

According to Rankiteo, CMC LTD is not certified under SOC 2 Type 1.

Does CMC LTD have SOC 2 Type 2 certification ?

According to Rankiteo, CMC LTD does not hold a SOC 2 Type 2 certification.

Does CMC LTD comply with GDPR ?

According to Rankiteo, CMC LTD is not listed as GDPR compliant.

Does CMC LTD have PCI DSS certification ?

According to Rankiteo, CMC LTD does not currently maintain PCI DSS compliance.

Does CMC LTD comply with HIPAA ?

According to Rankiteo, CMC LTD is not compliant with HIPAA regulations.

Does CMC LTD have ISO 27001 certification ?

According to Rankiteo,CMC LTD is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does CMC LTD operate in ?

CMC LTD operates primarily in the IT Services and IT Consulting industry.

How many employees does CMC LTD have ?

CMC LTD employs approximately 6,425 people worldwide.

Does CMC LTD own any subsidiaries ?

CMC LTD presently has no subsidiaries across any sectors.

How many LinkedIn followers does CMC LTD have ?

CMC LTD's official LinkedIn profile has approximately 51,827 followers.

What is the NAICS classification code for CMC LTD ?

CMC LTD is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.

Does CMC LTD have a Crunchbase profile ?

No, CMC LTD does not have a profile on Crunchbase.

Does CMC LTD have a LinkedIn profile ?

Yes, CMC LTD maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cmc-ltd.

How many cybersecurity incidents has CMC LTD experienced ?

As of September 14, 2026, Rankiteo reports that CMC LTD has experienced 14 cybersecurity incidents.

How many peer or competitor companies does CMC LTD have ?

CMC LTD has an estimated 41,656 peer or competitor companies worldwide.

What types of cybersecurity incidents has CMC LTD faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Cyber Attack, Breach and Ransomware.

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

CMC LTD

Boost Score +25 with badge (5 left)

765

/1000

Fair

790

/1000

Fair

CMC LTD Vendor Cyber Rating & Cyber Score

cmcltd.com

Add Your Compliance Badge

GLOBAL OUTLOOK: Part of $100 billion Tata Group Subsidiary of TCS – Asia’s Largest Global Software Services Company Over 12,000+ employees spread across India, USA, UK, Europe, MEA & APAC. 11 Development Centers across India & USA 3300+ experts in technologies & domain for Application Development Practice 978 strong skilled force in Embedded Systems Experience in setting up large ODCs up to 300+ team --------------------------------------------------------------------------------------------------------------------------------------------------------- HISTORY: Incorporate on December 26, 1975 Became a Public Limited Company in 1977 R&D Facility was setup in 1984 Acquired Baton Rouge International INC, 1991,Renamed as

CMC LTD

CMC LTD CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Tata Consultancy Se...

Breach

8/2026

TAT1786447303

Tata Consultancy Se...

Breach

8/2026

Microsoft

HCLTAT178644829...

Tata Steel

Ransomware

100

7/2026

TATBAN178522807...

Tata Group

Breach

6/2026

Tata Group

TATRED178260656...

Tata Group

Vulnerability

100

1/2026

Tata Group

MIC1773923106

CMC LTD

Cyber Attack

100

11/2025

TAT066210611172...

Tata Group

Ransomware

100

9/2025

Tata Group

MAR119341111042...

CMC LTD

Breach

100

5/2025

TAT203292010312...

CMC LTD

Ransomware

100

4/2025

TAT235040325

Tata Steel Nederlan...

Ransomware

100

2/2025

TAT1777667117

CMC LTD

Ransomware

1/2025

TAT702030425

Industrial By-Produ...

Breach

100

1/2025

Cellebrite

DELOPETATAPPCEL...

CMC LTD

Ransomware

10/2022

TAT000020325

Tata Consultancy Se...

Breach

8/2022

TAT1786447105

Loading…

A.I.

CMC LTD Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for CMC LTD

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for CMC LTD in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for CMC LTD in 2026.

Incident Types CMC LTD vs IT Services and IT Consulting Industry Avg (This Year)

No incidents recorded for CMC LTD in 2026.

Incident History - CMC LTD (X = Date, Y = Severity)

Loading…

SUBSIDIARY

CMC LTD Subsidiaries

CMC LTD

IT Services and IT Consulting

Website: https://http://www.cmcltd.com

Company Size: 6,425

Tata GroupExecutive Offices

Tata Consultancy ServicesIT Services and IT Consulting

Tata Consultancy Services - IndiaIT Services and IT Consulting

Future-Ready ManufacturingManufacturing

Tata Consultancy Services - JapanIT Services and IT Consulting

Tata Consultancy Services - UK and IrelandIT Services and IT Consulting

TCS Life Sciences and HealthcareIT Services and IT Consulting

Tata Consultancy Services – Asia PacificIT Services and IT Consulting

TCS BaNCSIT Services and IT Consulting

Tata Consultancy Services - UK and EuropeIT-services en consultancy

Tata Consultancy Services - ResearchResearch Services

TCS Digital Software & SolutionsIT Services and IT Consulting

Tata Consultancy Services - North AmericaIT Services and IT Consulting

TCS AI & Advanced TechIT Services and IT Consulting

Tata Consultancy Services - EuropeIT Services and IT Consulting

TCS Retail and Consumer GoodsIT Services and IT Consulting

TCS Financial Services and InsuranceIT Services and IT Consulting

Tata Consultancy Services LATAMServicios y tecnologías de la información

Tata MotorsMotor Vehicle Manufacturing

Bolt from Tata MotorsMotor Vehicle Manufacturing

Tata TechnologiesEngineering Services

iGETIT by Tata Technologies | Learning Solutions for EngineersE-learning

Taj HotelsHospitality

Taj InnerCircleHospitality

Tata ElxsiIT Services and IT Consulting

Tata Elxsi TransportationIT Services and IT Consulting

Tata Elxsi Healthcare and Life SciencesIT Services and IT Consulting

Tata Elxsi Media & CommunicationsIT Services and IT Consulting

Tata Elxsi JapanIT Services and IT Consulting

Tata Elxsi Design StudioIT Services and IT Consulting

Titan Company LimitedRetail

Titan Corporate GiftingRetail

Titan Watches IndiaManufacturing

Design Impact IndiaCivic and Social Organizations

Titan Precision ToolsMachinery Manufacturing

Xylys WatchesManufacturing

Titan MovementsRetail Luxury Goods and Jewelry

Tata Housing Development Company LimitedReal Estate

Tata Mutual FundFinancial Services

Prof.Simply SimpleFinancial Services

Tata Group - EuropeIndustrial Machinery Manufacturing

Tata International LimitedInternational Trade and Development

Tata HealthWellness and Fitness Services

Roz Ka DozHealth, Wellness & Fitness

Tata CapitalFinancial Services

Tata SteelMining

Tata Steel NederlandMining

Tata Steel i NordenMining

Packaging | Tata Steel NederlandPackaging and Containers Manufacturing

Multisteel | Tata Steel NederlandMining

Automotive | Tata Steel NederlandMotor Vehicle Manufacturing

Tubes | Tata Steel NederlandMining

Feijen | Tata Steel NederlandMining

Engineering | Tata Steel NederlandAgriculture, Construction, Mining Machinery Manufacturing

Gelsenkirchen | Tata Steel NederlandMining

Naantali Steel Service Centre @ Tata SteelMining

Layde | Tata Steel NederlandMining

Colors | Tata Steel NederlandBuilding Construction

CorusMining

Steel Recycling Business, Tata SteelMining

KalzipBuilding Materials

Tata Steel Industrial ConsultingOperations Consulting

Tata StructuraWholesale Building Materials

Tata Pravesh - Doors and WindowsFurniture and Home Furnishings Manufacturing

Colorcoat®Wholesale Building Materials

Automotive | Tata Steel IndiaMotor Vehicle Manufacturing

Tata WironMining

Industrial By-Products Management Division, Tata SteelMining

Loading…

CMC LTD Similar Companies

Apex Systems

apexsystems.com

Apex Systems is a leading global technology services firm that incorporates industry insights and experience to deliver solutions that fulfill our clients’ digital visions. We offer a continuum of services, specializing in strategy, transformation, and managed services across application development, data, enterprise platforms, cloud and infrastructure, and cybersecurity. Through our ability to innovate alongside our customers, we build and deploy the right artificial intelligence solutions to realize business value and improve customer experiences. Our alliances with cutting-edge technology partners empower our customers by providing them with the latest advancements. Apex has a presence in over 70 markets across North America, Europe, and India. Apex is a part of the commercial segment of ASGN Incorporated (NYSE: ASGN). To learn more, visit www.apexsystems.com. Apex strives to provide our talent with the best possible experience, from start to finish. Our commitment to excellence is reflected in many awards, including ClearlyRated's Best of Staffing® in Talent Satisfaction in the United States and Great Place to Work® in the United Kingdom and Mexico. Visit us today to join our team: www.apexsystems.com/careers.

Verizon

verizon.com

We get you. You want more out of a career. A place to share your ideas freely — even if they’re daring or different. Where the true you can learn, grow, and thrive. You’ll find all that here. Because we empower you. We power and empower how people live, work and play by connecting them to what brings them joy. The same is true inside our walls. We do what we love — driving innovation, creativity, and impact in the world. And wherever you go, we got your back. This is a team sport. Our V Team is a community of people who anticipate, lead, and believe that listening is where learning begins. In crisis and in celebration, we come together— lifting our communities and building trust in how we show up, everywhere & always. Want in? Join the V Team Life.

Luxoft

luxoft.com

Luxoft, a DXC Technology Company (NYSE: DXC), is a digital strategy and software engineering firm providing bespoke technology solutions that drive business change for customers the world over. Acquired by U.S. company DXC Technology in 2019, Luxoft is a global operation in 44 cities and 21 countries with an international, agile workforce of nearly 18,000 people. It combines a unique blend of engineering excellence and deep industry expertise, helping over 425 global clients innovate in the areas of automotive, financial services, travel and hospitality, healthcare, life sciences, media and telecommunications. DXC Technology is a leading Fortune 500 IT services company which helps global companies run their mission critical systems. Together, DXC and Luxoft offer a differentiated customer-value proposition for digital transformation by combining Luxoft’s front-end digital capabilities with DXC’s expertise in IT modernization and integration. Follow our profile for regular updates and insights into technology and business needs.

SoftwareOne

softwareone.com

SoftwareOne is a global software and cloud solutions provider. With a presence in over 70 countries and a team of around 13,000 professionals, we combine global scale and local expertise to help clients optimize costs, accelerate growth, and navigate complex IT environments with confidence. Leveraging deep capabilities in cloud, software, and data and AI, the company empowers organizations to modernize, innovate, and unlock the full value of their technology investments. Headquartered in Switzerland, SoftwareOne is listed on the SIX Swiss Exchange and Euronext Oslo Børs under the ticker symbol SWON. Visit us: https://www.softwareone.com/en

Wipro

wipro.com

Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO) is a leading AI-powered technology services and consulting company focused on building innovative solutions that address clients’ most complex digital transformation needs. Leveraging our consulting-led approach and the Wipro Intelligence™ unified suite of AI-powered platforms, solutions, and transformative offerings, we help clients realize their boldest ambitions and build intelligent, sustainable businesses. The Wipro Innovation Network—part of the Wipro Intelligence™ suite—underpins our commitment to client-centric co-innovation and co-creation by bringing together capabilities from the innovation labs and partner ecosystems, academia, and global tech communities. With over 230,000 employees and business partners across 65 countries, we deliver on the promise of helping our customers, colleagues, and communities thrive in an ever-changing world.

Lenovo

lenovo.com

Lenovo is a US$83 billion revenue global technology powerhouse, ranked #196 in the Fortune Global 500, and serving millions of customers every day in 180 markets. Guided by its vision of “Smarter Technology for All”, Lenovo is executing a Hybrid AI strategy that spans Personal AI – one personal AI, multiple devices; and Enterprise AI – helping customers turn data into insights and value. This strategy is delivered through the Group’s commitment to world-class innovation and a full-stack AI portfolio, including devices (PCs, workstations, smartphones, tablets, accessories), infrastructure solutions (server, storage, edge, high performance computing and software defined infrastructure), as well as software, solutions, and services. With a global footprint spanning 21 research and development locations in 11 markets, and a global supply chain including more than 30 manufacturing sites across 10 markets, Lenovo is widely recognized for its operational excellence, including ranking #8 in the Gartner Supply Chain Top 25. Lenovo is listed on the Hong Kong stock exchange under Lenovo Group Limited (HKSE: 992) (ADR: LNVGY). To find out more visit https://www.lenovo.com, and read about the latest news via our StoryHub at https://news.lenovo.com/. To learn more about our career opportunities, visit our careers page at http://jobs.lenovo.com/.

Asurion

cb asurion.com

As the world’s leading tech care company, Asurion eliminates the fears and frustrations associated with technology, to ensure our 300 million customers get the most out of their devices, appliances and connections. We provide insurance, repair, replacement, installation and 24/7 support for everything from cellphones to laptops and household appliances. Our experts are available online, on the phone, at one of our more than 800 stores, or can even come to you.

Ricoh USA, Inc.

ricoh-usa.com

At Ricoh, we bring people, processes, and technology together to make information work for you. We unlock the power of information so organizations can unlock the full potential of their people. We're a leader in information management and digital services, creating competitive advantage for over 1.4 million businesses across the globe. Our team members serve a vast array of industries, using an innovative mix of people, processes, and technology to free trapped and hidden insights. We believe having access to the right information translates to better business agility, more human experiences, and the ability to thrive in today's age of hybrid and borderless work.

Tata Consultancy Services

tcs.com

Tata Consultancy Services (TCS) is the technology partner of choice for industry leading organizations worldwide. Since its inception in 1968, TCS has upheld the highest standards of innovation, engineering excellence, and customer service. It has set an aspiration to become the world's largest AI-led technology services company and is enabling its clients to transform themselves across the full AI stack, from infrastructure to intelligence. Rooted in the heritage of the Tata Group, TCS is focused on creating long term value for its clients, its investors, its employees, and the community at large. With a highly skilled workforce spread across 55 countries and 202 service delivery centers across the world, the company has been recognized as a top employer in six continents. With the ability to rapidly apply and scale new technologies, the company has built long term partnerships with its clients – helping them emerge as perpetually adaptive enterprises. Many of these relationships have endured into decades and navigated every technology cycle, from mainframes in the 1970s to artificial intelligence today. TCS sponsors 14 of the world’s most prestigious marathons and endurance events, including the TCS New York City Marathon, TCS London Marathon and TCS Sydney Marathon with a focus on promoting health, sustainability, and community empowerment. Caution against fraudulent job offers: TCS doesn’t charge any fee throughout the recruitment process. Refer here: https://www.tcs.com/careers/india/recruitment-fraud-alert

Loading…

NEWS

CMC LTD CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 08, 2025 08:00 AM

2026 Defence & Cyber Security Outlook: Where Software Meets Steel

Palantir leads a new era of software-driven defence as the US overhauls military procurement and AI reshapes cyber warfare.

Read Article

November 05, 2025 08:00 AM

BTQ Stock: This Quantum Firm is Prepping for Cyber Security Doomsday

As experts weigh the cyber security risks posed by quantum technology, BTQ's offerings are exciting investors.

Read Article

October 23, 2025 07:00 AM

Cyber attack on Jaguar Land Rover estimated to cost UK economy £1.9 billion

The Cyber Monitoring Centre (CMC) has classified the recent attack that disrupted Jaguar Land Rover (JLR) operations as a Category 3...

Read Article

October 22, 2025 07:00 AM

Jaguar Land Rover ransomware attack had $2.8B economic impact in UK

The UK's Cyber Monitoring Centre (CMC) on Oct. 22 estimated that the economic impact of the Sept. 2 cybersecurity incident affecting Jaguar...

Read Article

August 29, 2025 07:00 AM

CRWD Stock: Can CrowdStrike Reinvent Cybersecurity?

CrowdStrike Holdings [CRWD] is seeing steady revenue growth, sticky customers and a surging share price.

Read Article

June 25, 2025 07:00 AM

Financial impact of cyber attacks on UK retailers laid bare in new report

Cyber attacks against M&S and Co-op earlier this year cost anywhere between £270 million to £440m, according to analysis by the Cyber Monitoring Centre.

Read Article

June 24, 2025 07:00 AM

Cost of M&S and Co-op cyber attacks up to £440m – CMC

The total financial impact of the recent cyber attacks experienced by retailers Marks and Spencer (M&S) and Co-op is somewhere in the region of £270m to £440m.

Read Article

June 18, 2025 07:00 AM

CYBERSECURITY INCIDENT RESPONSE: CONCRETE ACTIONS NEEDED

Hanoi (VNA) – As Vietnam's digital transformation accelerates, both the frequency and severity of cyberattacks are growing.

Read Article

May 28, 2025 07:00 AM

Urgent action needed as over 650,000 cyberattacks hit Vietnam in 2024

A hacker hid in a Vietnamese company's system for 9 months before attacking, revealing major cybersecurity gaps.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-90603

SUMMARY

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

Published

Date2026-09-13

Updated

Date2026-09-13

RISK INFORMATION (Score: 7.3)

cvss2

Base Score: 7.5

Complexity: LOW

AV:N/AC:L/Au:N/C:P/I:P/A:P

cvss3

Base Score: 7.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

3.4

Exploitability

3.9

REFERENCES

CVE-2026-90602

SUMMARY

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

Published

Date2026-09-13

Updated

Date2026-09-13

RISK INFORMATION (Score: 3.5)

cvss2

Base Score: 4.0

Complexity: LOW

AV:N/AC:L/Au:S/C:N/I:P/A:N

cvss3

Base Score: 3.5

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

cvss4

Base Score: 5.1

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

1.4

Exploitability

2.1

REFERENCES

CVE-2026-90601

SUMMARY

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

Published

Date2026-09-13

Updated

Date2026-09-13

RISK INFORMATION (Score: 7.3)

cvss2

Base Score: 7.5

Complexity: LOW

AV:N/AC:L/Au:N/C:P/I:P/A:P

cvss3

Base Score: 7.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

3.4

Exploitability

3.9

REFERENCES

CVE-2026-90600

SUMMARY

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Published

Date2026-09-13

Updated

Date2026-09-13

RISK INFORMATION (Score: 6.3)

cvss2

Base Score: 6.5

Complexity: LOW

AV:N/AC:L/Au:S/C:P/I:P/A:P

cvss3

Base Score: 6.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

cvss4

Base Score: 2.1

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

3.4

Exploitability

2.8

REFERENCES

CVE-2026-15892

SUMMARY

The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name buffer (and, for read, a data buffer) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, relying on the end: label to k_free() them. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning status MGMT_CB_ERROR_RC, the handler executed return ret_rc; directly, bypassing end: and leaking the heap allocation on every rejected request. The settings handlers are reachable over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP, depending on product configuration). The access hook is the mechanism applications use to deny unauthorized settings access, and MGMT_CB_ERROR_RC is a common rejection style, so an attacker who can send settings read/write/delete commands that the hook rejects triggers a heap leak on each attempt. Because the leaked memory is never reclaimed until reboot, a sustained stream of rejected requests monotonically exhausts the kernel heap until k_malloc() fails, denying mcumgr service and impacting any other heap consumer on the device — a denial of service. The impact is availability-only; there is no memory corruption or information disclosure. Only configurations that select the heap buffer type, enable the access hook, and register a hook that returns MGMT_CB_ERROR_RC are affected (the default stack buffer type cannot leak).

Published

Date2026-09-13

Updated

Date2026-09-13

RISK INFORMATION (Score: 5.3)

cvss3

Base Score: 5.3

Complexity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Impact Score

1.4

Exploitability

3.9

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…

Badge your company to reduce your risk score and your cyber insurance costs!

Trusted by insurers. Chosen by leaders.

CMC LTD Vendor Cyber Rating & Cyber Score

CMC LTD A.I CyberSecurity Scoring

CMC LTD CyberSecurity News & History

CMC LTD Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for CMC LTD

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types CMC LTD vs IT Services and IT Consulting Industry Avg (This Year)

Incident History - CMC LTD (X = Date, Y = Severity)

CMC LTD Subsidiaries

CMC LTD

CMC LTD Similar Companies

Apex Systems

Verizon

Luxoft

SoftwareOne

Wipro

Lenovo

Asurion

Ricoh USA, Inc.

Tata Consultancy Services

CMC LTD CyberSecurity News

2026 Defence & Cyber Security Outlook: Where Software Meets Steel

BTQ Stock: This Quantum Firm is Prepping for Cyber Security Doomsday

Cyber attack on Jaguar Land Rover estimated to cost UK economy £1.9 billion

Jaguar Land Rover ransomware attack had $2.8B economic impact in UK

CRWD Stock: Can CrowdStrike Reinvent Cybersecurity?

Financial impact of cyber attacks on UK retailers laid bare in new report

Cost of M&S and Co-op cyber attacks up to £440m – CMC

CYBERSECURITY INCIDENT RESPONSE: CONCRETE ACTIONS NEEDED

Urgent action needed as over 650,000 cyberattacks hit Vietnam in 2024

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo

CMC LTD CyberSecurity News & History

CMC LTD Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Incident Predictions locked

A.I Risk Score Likelihood 3 - 6 - 9 months

A.I. Risk Score Predictions locked

Underwriter Stats for CMC LTD

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types CMC LTD vs IT Services and IT Consulting Industry Avg (This Year)

Incident History - CMC LTD (X = Date, Y = Severity)

CMC LTD Subsidiaries

CMC LTD

CMC LTD Similar Companies

Apex Systems

Verizon

Luxoft

SoftwareOne

Wipro

Lenovo

Asurion

Ricoh USA, Inc.

Tata Consultancy Services

CMC LTD CyberSecurity News

2026 Defence & Cyber Security Outlook: Where Software Meets Steel

BTQ Stock: This Quantum Firm is Prepping for Cyber Security Doomsday

Cyber attack on Jaguar Land Rover estimated to cost UK economy £1.9 billion

Jaguar Land Rover ransomware attack had $2.8B economic impact in UK

CRWD Stock: Can CrowdStrike Reinvent Cybersecurity?

Financial impact of cyber attacks on UK retailers laid bare in new report

Cost of M&S and Co-op cyber attacks up to £440m – CMC

CYBERSECURITY INCIDENT RESPONSE: CONCRETE ACTIONS NEEDED

Urgent action needed as over 650,000 cyberattacks hit Vietnam in 2024

Global CVEs (Not Company-Specific)

Access Data Using Our API

What Do We Measure ?

These are some of the factors we use to calculate the overall score:

Rankiteo