EUVD-2026-54221
GHSA-ch5q-j8ff-mq34
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CoAP in NoSec default requires no auth (PR:N); heap key material disclosure warrants C:H; parse-offset corruption gives I:L; device crash potential from corrupted loop state gives A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
AnalysisAI
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in lwm2m_tlv_read() (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Contiki-NG is an open-source RTOS for constrained IoT devices implementing OMA LwM2M over CoAP/UDP. The affected code path is the TLV (Type-Length-Value) deserializer in os/services/lwm2m/lwm2m-tlv.c, which decodes object instances in LwM2M WRITE operations. CWE-125 (Out-of-Bounds Read) is the root cause: lwm2m_tlv_read() accepts a caller-supplied len argument representing remaining buffer bytes but performs no bounds validation before indexing into the buffer for the type byte, one or two ID bytes, zero to three length bytes, and the value field - a maximum of six bytes total. The caller loop in lwm2m-engine.c iterates while tlvpos < insize, and because it only requires one remaining byte to re-enter the loop, a one-byte final TLV bypasses any incidental protection. The commit diff confirms the fix adds three explicit guards: a minimum 2-byte header check, a check that len_pos + len_type <= len before reading ID and length fields, and a check that tlv_len <= len - len_pos before assigning the value pointer. No CPE string was provided; the canonical repository is https://github.com/contiki-ng/contiki-ng.
RemediationAI
The upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997, available at https://github.com/contiki-ng/contiki-ng/commit/f1673b5766d4d4d514cefb8a0350f43653574997, and tracked via pull request #3165 (https://github.com/contiki-ng/contiki-ng/pull/3165). Integrators should cherry-pick this commit into their Contiki-NG builds immediately; a tagged release has not been confirmed so monitor https://github.com/contiki-ng/contiki-ng for an official version tag. As the most effective compensating control, enabling LwM2M DTLS security mode (disabling NoSec) eliminates the unauthenticated attack vector entirely by requiring credential negotiation before any WRITE is processed - the trade-off is increased RAM, flash, and power consumption on constrained hardware, and the requirement to provision PSK or certificate credentials. If DTLS cannot be enabled, restricting CoAP UDP port 5683 at the network perimeter to known LwM2M server addresses reduces exposure, though this does not help when the attacker is on the same LAN or mesh segment. Disabling the LwM2M service at compile time (removing os/services/lwm2m/ from the build) eliminates the attack surface entirely if the service is not required.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today