CVE-2017-7243

High

Published: 24/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Eclipse tinydtls version 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a 'Change cipher spec' packet without pre-handshake.

Risk Assessment

Attackers can cause service outages, which may affect the availability of the system and its components within the organization.

Recommendation

It is recommended to upgrade to a newer version of Eclipse tinydtls to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Eclipse tinydtls 0.8.2

CVE-2026-9267Medium
Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function. An unauthenticated attacker can trigger reads beyond valid buffer boundaries by crafting a Certificate handshake message with a specific fragment_length value.

Original NVD description (English source)

Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a "Change cipher spec" packet without pre-handshake.