Skip to main content

Riot CVE-2019-1000006

CRITICAL
Out-of-bounds Write (CWE-787)
2019-02-04 cve@mitre.org
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Feb 04, 2019 - 21:29 nvd
CRITICAL 9.8

DescriptionNVD

RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.

AnalysisAI

RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity. Affected products include: Riot-Os Riot.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).

More in Riot

View all
CVE-2023-33975 CRITICAL POC
9.8 May 30

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process

CVE-2026-25139 CRITICAL POC
9.1 Feb 04

RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o

CVE-2024-32018 CRITICAL POC
9.0 May 01

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a

CVE-2024-32017 CRITICAL POC
9.0 May 01

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a

CVE-2024-31225 CRITICAL POC
9.0 May 01

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a

CVE-2024-52802 HIGH POC
7.5 Nov 22

RIOT is an operating system for internet of things (IoT) devices. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2023-24818 HIGH POC
7.5 Apr 24

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc

CVE-2019-16754 HIGH POC
7.5 Sep 24

RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attac

CVE-2019-15702 HIGH POC
7.5 Aug 27

In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all input

CVE-2019-15134 HIGH POC
7.5 Aug 17

RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all me

CVE-2024-53980 MEDIUM POC
6.9 Nov 29

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)

CVE-2017-8289 CRITICAL
9.8 Apr 27

Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c i

Share

CVE-2019-1000006 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy