Deserialization in Coapthon Project
CVE-2018-12680
The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.
Vulnerability class: Insecure Deserialization
EPSS: 0.015 (71.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Coapthon_project Coapthon — versions 3.1, 4.0.0, 4.0.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2018-12680?
- CVE-2018-12680 is a high-severity vulnerability in Coapthon Project, classified under Deserialization of Untrusted Data. CVSS score: 7.5/10. Published 2019-04-02.
- How severe is CVE-2018-12680?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-12680 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.