Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-50927

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.

Published

2024-02-14T20:15:45.367

Last Modified

2025-01-07T14:53:39.337

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.6 (HIGH)

Weaknesses

Type: Secondary
CWE-125
Type: Primary
CWE-125

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	contiki-ng	contiki-ng	< 4.9	Yes

References

https://github.com/contiki-ng/contiki-ng/pull/2484 Issue Tracking ([email protected])
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw Vendor Advisory ([email protected])
https://github.com/contiki-ng/contiki-ng/pull/2484 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)