CVE Feed

    Dashboard / CVE / CVE-2022-35926

    CVE-2022-35926

    Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option header and the Source Link-Layer Address Option (SLLAO). This attack requires ipv6 be enabled for the network. The problem has been patched in the develop branch of Contiki-NG. The upcoming 4.8 release of Contiki-NG will include the patch.Users unable to upgrade may apply the patch in Contiki-NG PR #1654.

    Published:Aug 4, 2022
    Last Modified:Apr 23, 2025
    EPS:Aug 4, 2022
    EPSS Score:0.00534
    CVSS Score:5.9

    Affected Products

    Vendor
    Contiki-ng
    Product
    Contiki-ng

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-5857 (CVSS 9.2) — Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before…
    CVE-2026-5856 (CVSS 7.1) — Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels wi…
    CVE-2026-5855 (CVSS 8.7) — Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied bu…
    CVE-2023-29001 (CVSS 8.7) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system…
    CVE-2024-41125 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-41126 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-47181 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can …
    CVE-2023-50926 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…
    CVE-2023-50927 (CVSS 8.6) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can…
    CVE-2023-48229 (CVSS 7) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High