Vulnerability Report

CVE-2024-41126

Title: Contiki-Ng Memory Corruption

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2024-41126.

CWE Category CWE-125
Published Date Nov 27, 2024
Modified Date Apr 10, 2025
Exploit Status Not Found
Score 8.3 CVSS v3.1
Exploit Probability (EPSS)
0.09%

Vulnerability Summary

CVE-2024-41126: Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-message.c module, where the snmp_message_decode function fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The problem has been patched in Contiki-NG pull request 2937. It will be included in the next release of Contiki-NG. Users are advised to either apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.

Impacted Vendors

C
contiki-ng 1
C
contiki-ng_project 1

Reference Links

https://github.com/contiki-ng/contiki-ng/pull/2937 https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-444j-93j3-5gj4
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.3
Attack Vector
ADJACENT_NETWORK
Complexity
HIGH
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.6
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2024-41126 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector ADJACENT_NETWORK
Complexity HIGH
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.