cppcheck pointed out that usbd_cdc.c has a missing break statement around line 652.
The next case is a default:/break;, but if another case is inserted between the offender and the default, a fall through would happen.
A good catch. By the way, ability to do code reviews by community is one of reasons to put the STM32 libraries on GitHub. The recent news of Microsoft acquisition may scare some people away from GitHub... but there still are other git hosters - Bitbucket, for one.
Retrieving data ...