Openthread
Monthly
NAT64 translation in OpenThread (all platforms, before commit 26a882d) allows an unauthenticated attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into a Thread mesh by exploiting missing IPv4 option validation. The root cause is that the translator stripped only the fixed 20-byte IPv4 header (sizeof(Ip4::Header)) rather than the actual header length derived from the IHL field, leaving raw option bytes - including LSRR and SSRR source-routing options - to be misinterpreted as upper-layer protocol payload in the translated IPv6 packet. No public exploit is identified at time of analysis; EPSS is 0.03% and SSVC indicates no current exploitation, consistent with the adjacency and NAT64-configuration prerequisites.
OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg:. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
NAT64 translation in OpenThread (all platforms, before commit 26a882d) allows an unauthenticated attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into a Thread mesh by exploiting missing IPv4 option validation. The root cause is that the translator stripped only the fixed 20-byte IPv4 header (sizeof(Ip4::Header)) rather than the actual header length derived from the IHL field, leaving raw option bytes - including LSRR and SSRR source-routing options - to be misinterpreted as upper-layer protocol payload in the translated IPv6 packet. No public exploit is identified at time of analysis; EPSS is 0.03% and SSVC indicates no current exploitation, consistent with the adjacency and NAT64-configuration prerequisites.
OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg:. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.