Unknown · Contiki-Ng · CVE-2024-41125
**Name of the Vulnerable Software and Affected Versions**
Contiki-NG (affected versions not specified)
**Description**
An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the os/net/app-layer/snmp/snmp-ber.c module, specifically in the `snmp ber decode string len buffer` function, which decodes the string length from a received SNMP packet. The problem arises when one byte is read from the buffer without checking if another byte is available, leading to a possible out-of-bounds read.
**Recommendations**
To resolve the issue, apply the patch manually from Contiki-NG pull request #2936 or wait for the next release of Contiki-NG.
As a temporary workaround, consider disabling the SNMP module in the Contiki-NG build configuration to minimize the risk of exploitation.