CVE Feed

    Dashboard / CVE / CVE-2022-35927

    CVE-2022-35927

    Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.

    Published:Aug 4, 2022
    Last Modified:Apr 23, 2025
    EPS:Aug 4, 2022
    EPSS Score:0.00579
    CVSS Score:8.1

    Affected Products

    Vendor
    Contiki-ng
    Product
    Contiki-ng

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-5857 (CVSS 9.2) — Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before…
    CVE-2026-5856 (CVSS 7.1) — Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels wi…
    CVE-2026-5855 (CVSS 8.7) — Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied bu…
    CVE-2023-29001 (CVSS 8.7) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system…
    CVE-2024-41125 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-41126 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-47181 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can …
    CVE-2023-50926 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…
    CVE-2023-50927 (CVSS 8.6) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can…
    CVE-2023-48229 (CVSS 7) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High