diff --git a/clients/cloud-setup/nm-cloud-setup-utils.c b/clients/cloud-setup/nm-cloud-setup-utils.c
index f09d1e5988..24b3ee6a29 100644
--- a/clients/cloud-setup/nm-cloud-setup-utils.c
+++ b/clients/cloud-setup/nm-cloud-setup-utils.c
@@ -495,8 +495,17 @@ nmcs_utils_hwaddr_normalize(const char *hwaddr, gssize len)
         if (!hwaddr)
             return NULL;
         l = strlen(hwaddr);
-    } else
+    } else {
         l = len;
+        if (l > 0 && hwaddr[l - 1] == '\0') {
+            /* we accept one '\0' at the end of the string. */
+            l--;
+        }
+        if (memchr(hwaddr, '\0', l)) {
+            /* but we don't accept other NUL characters in the middle. */
+            return NULL;
+        }
+    }
 
     if (l == 0)
         return NULL;
diff --git a/clients/cloud-setup/nm-cloud-setup-utils.h b/clients/cloud-setup/nm-cloud-setup-utils.h
index c2a3d30949..217f07550e 100644
--- a/clients/cloud-setup/nm-cloud-setup-utils.h
+++ b/clients/cloud-setup/nm-cloud-setup-utils.h
@@ -78,6 +78,16 @@ gboolean nmcs_utils_poll_finish(GAsyncResult *result, gpointer *probe_user_data,
 
 char *nmcs_utils_hwaddr_normalize(const char *hwaddr, gssize len);
 
+static inline char *
+nmcs_utils_hwaddr_normalize_gbytes(GBytes *hwaddr)
+{
+    const char *str;
+    gsize       len;
+
+    str = g_bytes_get_data(hwaddr, &len);
+    return nmcs_utils_hwaddr_normalize(str, len);
+}
+
 /*****************************************************************************/
 
 const char *nmcs_utils_parse_memmem(GBytes *mem, const char *needle);
diff --git a/clients/cloud-setup/nmcs-provider-azure.c b/clients/cloud-setup/nmcs-provider-azure.c
index a18a0d64b4..65ff058c77 100644
--- a/clients/cloud-setup/nmcs-provider-azure.c
+++ b/clients/cloud-setup/nmcs-provider-azure.c
@@ -315,7 +315,7 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     if (error)
         goto out_done;
 
-    iface_data->hwaddr = nmcs_utils_hwaddr_normalize(g_bytes_get_data(response, NULL), -1);
+    iface_data->hwaddr = nmcs_utils_hwaddr_normalize_gbytes(response);
 
     if (!iface_data->hwaddr)
         goto out_done;
diff --git a/clients/cloud-setup/nmcs-provider-gcp.c b/clients/cloud-setup/nmcs-provider-gcp.c
index a8b50f98f7..d30749484f 100644
--- a/clients/cloud-setup/nmcs-provider-gcp.c
+++ b/clients/cloud-setup/nmcs-provider-gcp.c
@@ -261,7 +261,7 @@ _get_config_iface_cb(GObject *source, GAsyncResult *result, gpointer user_data)
     if (error)
         goto out_error;
 
-    hwaddr = nmcs_utils_hwaddr_normalize(g_bytes_get_data(response, NULL), -1);
+    hwaddr                       = nmcs_utils_hwaddr_normalize_gbytes(response);
     iface_data->iface_get_config = g_hash_table_lookup(get_config_data->result_dict, hwaddr);
     if (!iface_data->iface_get_config) {
         _LOGI("GCP interface[%" G_GSSIZE_FORMAT "]: did not find a matching device",