CVE-2018-1000804

contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack).

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-08

Last modified

2024-09-16

Weaknesses

CWE-119

Affected products

• Contiki-ng (Contiki-ng)

References

• https://github.com/contiki-ng/contiki-ng/issues/594
• https://github.com/contiki-ng/contiki-ng/pull/624