Please report suspected security vulnerabilities privately to the Apache Security Team at security@apache.org, following the ASF process at https://www.apache.org/security/. Do not open public GitHub issues or pull requests for security reports.

Apache mcumgr's security threat model — its scope and intended use, trust boundaries, the security properties it does and does not provide, the adversary model, and a list of recurring non-findings — is documented in THREAT_MODEL.md.

Key point for triagers and scanners: SMP provides no authentication, authorization, confidentiality, or replay protection of its own. Those properties are delegated to the transport (e.g. BLE link encryption) and the integrator, and firmware-image authenticity is enforced by the signature-verifying bootloader (MCUboot), not by mcumgr. See THREAT_MODEL.md §9 and §11a.