CVE-2021-42146

Published Jan 24, 2024

Last updated 5 months ago

Overview

Description: An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-755

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:contiki-ng:tinydtls:2018-08-30:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "90402650-48E8-4C88-9306-B32811E56046"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References