CVEvulnerability

CVE-2021-42146

7.5 HIGH Published 2024-01-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-303, CWE-755

Description

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).

Affected configurations

• contiki-ng tinydtls 2018-08-30

Related

Weakness · CWE (2)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References