CVE-2026-22213

{"id": "CVE-2026-22213", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22213", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T18:37:33.649371Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RIOT-OS/RIOT", "vendor": "RIOT", "product": "RIOT OS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.01-devel-317"}], "packageURL": "pkg:github/RIOT-OS/RIOT", "defaultStatus": "unknown"}]}], "published": "2026-01-12T23:15:52.300", "references": [{"url": "https://github.com/RIOT-OS/RIOT", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://seclists.org/fulldisclosure/2026/Jan/15", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.riot-os.org/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/riot-os-stack-based-buffer-overflow-in-tapslip6-utility", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input. The utility uses strcpy() and strcat() to concatenate the fixed prefix '/dev/' with a user-supplied device name provided via the -s command-line option without bounds checking. This allows an attacker to supply an excessively long device name and overflow a fixed-size stack buffer, leading to process crashes and memory corruption."}, {"lang": "es", "value": "Las versiones de RIOT OS hasta e incluyendo 2026.01-devel-317 contienen una vulnerabilidad de desbordamiento de b\u00fafer basado en pila en la utilidad tapslip6. La vulnerabilidad es causada por una concatenaci\u00f3n de cadenas insegura en la funci\u00f3n devopen(), que construye una ruta de dispositivo utilizando una entrada controlada por el usuario sin l\u00edmites. La utilidad utiliza strcpy() y strcat() para concatenar el prefijo fijo '/dev/' con un nombre de dispositivo proporcionado por el usuario, suministrado a trav\u00e9s de la opci\u00f3n de l\u00ednea de comandos -s, sin verificaci\u00f3n de l\u00edmites. Esto permite a un atacante suministrar un nombre de dispositivo excesivamente largo y desbordar un b\u00fafer de pila de tama\u00f1o fijo, lo que lleva a fallos del proceso y corrupci\u00f3n de memoria."}], "lastModified": "2026-07-14T16:16:49.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EE45C18-0705-45D6-9363-63017333DFF1", "versionEndExcluding": "2025.10"}, {"criteria": "cpe:2.3:o:riot-os:riot:2026.01:devel:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51045419-7276-4017-8857-04DDBF865A1F"}, {"criteria": "cpe:2.3:o:riot-os:riot:2026.01:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D10D5F2C-4666-4D21-AED8-BE67DF223745"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}