CVE-2020-11068

Name of the Vulnerable Software and Affected Versions LoRaMac-node versions prior to 4.4.4

Description The issue is related to a reception buffer overflow due to the lack of checking the received buffer size. This can be exploited by a remote attacker to cause a denial of service in end devices during the over-the-air activation (OTAA) process.

Recommendations For versions prior to 4.4.4, update to version 4.4.4 to resolve the issue. As a temporary workaround, consider implementing input validation to check the size of the received buffer before processing it. Restrict access to the vulnerable function until a patch is available.