CVE-2020-24336: contiki-ng Classic Buffer Overflow
Vulnerability summary
CVE-2020-24336 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in contiki-ng. EPSS estimates a 59.09% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities.
Timeline
- 11-12-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. This bug can be exploited whenever NAT64 is enabled.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
59.09%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 59.09% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Contiki-ng1 product
- contiki-ng≤ 4.5
Contiki-os1 product
- contiki≤ 3.0
2 vendors · 2 products
References
2 links- us-cert.cisa.gov/ics/advisories/icsa-20-343-01X Refsource MISCThird Party AdvisoryUS Government Resource