CVE-2024-0962

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
obgm	libcoap	4.3.4

References

https://github.com/obgm/libcoap/issues/1310Exploit, Patch
https://github.com/obgm/libcoap/issues/1310#issue-2099860835Exploit, Issue Tracking
https://github.com/obgm/libcoap/pull/1311Issue Tracking, Patch
https://vuldb.com/?ctiid.252206Permissions Required
https://vuldb.com/?id.252206Third Party Advisory
https://github.com/obgm/libcoap/issues/1310Exploit, Patch
https://github.com/obgm/libcoap/issues/1310#issue-2099860835Exploit, Issue Tracking
https://github.com/obgm/libcoap/pull/1311Issue Tracking, Patch
https://vuldb.com/?ctiid.252206Permissions Required
https://vuldb.com/?id.252206Third Party Advisory

Timeline

Published: Jan 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-09635.4The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode CVE-2024-09649.4A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.CVE-2024-09655.3The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including CVE-2024-09665.4The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions u CVE-2024-09674.3A potential vulnerability has been identified in OpenText / Micro Focus ArcSight Enterprise Security Manager (ESM). The vulnerability could CVE-2024-09695.3The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST CVE-2024-09705.3This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing CVE-2024-09716.5A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content.CVE-2024-09725.3The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 CVE-2024-09736.1The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privi CVE-2024-09744.8The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2024-09755.3The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.