Eclipse Tinydtls vulnerabilities

2 CVEs affecting Eclipse Tinydtls, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34430, published 2021-07-08.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-7243, published 2017-03-24. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a "Change cipher spec" packet without pre-handshake.
• CVE-2021-34430, published 2021-07-08. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic.