Owen Cochell

**Name of the Vulnerable Software and Affected Versions** Contiki-NG (affected versions not specified) **Description** An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the os/net/app-layer/snmp/snmp-ber.c module, specifically in the `snmp ber decode string len buffer` function, which decodes the string length from a received SNMP packet. The problem arises when one byte is read from the buffer without checking if another byte is available, leading to a possible out-of-bounds read. **Recommendations** To resolve the issue, apply the patch manually from Contiki-NG pull request #2936 or wait for the next release of Contiki-NG. As a temporary workaround, consider disabling the SNMP module in the Contiki-NG build configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contiki-NG (affected versions not specified) **Description** An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the os/net/app-layer/snmp/snmp-message.c module, specifically in the `snmp message decode` function, which fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The SNMP module is disabled in the default Contiki-NG configuration. **Recommendations** To resolve the issue, users are advised to either apply the patch manually from Contiki-NG pull request 2937 or wait for the next release. As a temporary workaround, consider disabling the SNMP module in the Contiki-NG build configuration.