CVE-2024-52802

RIOT is an operating system for internet of things (IoT) devices. In version 2024.04 and prior, the function `_parse_advertise`, located in `/sys/net/application_layer/dhcpv6/client.c`, has no minimum header length check for `dhcpv6_opt_t` after processing `dhcpv6_msg_t`. This omission could lead to an out-of-bound read, causing system inconsistency. Additionally, the same lack of a header length check is present in the function `_preparse_advertise`, which is called by `_parse_advertise` before handling the request. As of time of publication, no known patched version exists.

• CWE-20
• CWE-125

• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xgv3-pcq6-qmrgExploit, Vendor Advisory

Published

Nov 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52797Opencast is free and open source software for automated vide…7.5
• CVE-2024-52798path-to-regexp turns path strings into a regular expressions…7.7
• CVE-2024-52799Argo Workflows Chart is used to set up argo and its needed d…8.2
• CVE-2024-5280The wp-affiliate-platform WordPress plugin before 6.5.1 does…4.7
• CVE-2024-52800veraPDF is an open source PDF/A validation library. Executin…2.3
• CVE-2024-52801sftpgo is a full-featured and highly configurable event-driv…5.3
• CVE-2024-52803LLama Factory enables fine-tuning of large language models. …9.8
• CVE-2024-52804Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2024-52805Synapse is an open-source Matrix homeserver. In Synapse befo…7.5
• CVE-2024-52806SimpleSAMLphp SAML2 library is a PHP library for SAML2 relat…8.3
• CVE-2024-52807The HL7 FHIR IG publisher is a tool to take a set of inputs …8.6
• CVE-2024-52809vue-i18n is an internationalization plugin for Vue.js. In a…5.3