CVE-2023-24826 MEDIUM

CVE-2023-24826: Usage of Uninitialized Timer during forwarding of Fragments with SFR

Vendor Riot-Os
Product RIOT
Weakness CWE-824
Published May 30, 2023
Last update January 10, 2025
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 10, 2025 Record updated