CVE-2021-42146: High severity Contiki-NG tinyDTLS vulnerability

Published Jan 24, 2024

Updated

An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).

Affected Software

1 affected component

Contiki-NG tinyDTLS=2018-08-30

Event History

Jan 24, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-42146?

CVE-2021-42146 is classified as a high severity vulnerability due to the potential for remote attackers to exploit it.

How do I fix CVE-2021-42146?

To fix CVE-2021-42146, update to the latest version of tinyDTLS where this vulnerability is addressed.

What does CVE-2021-42146 allow an attacker to do?

CVE-2021-42146 allows remote attackers to reuse epoch numbers, which can lead to sensitive data exposure.

In which software is CVE-2021-42146 found?

CVE-2021-42146 affects the tinyDTLS implementation in Contiki-NG.

When was CVE-2021-42146 discovered?

CVE-2021-42146 was identified in the master branch of tinyDTLS with a commit dated August 30, 2018.