CVE Feed

    Dashboard / CVE / CVE-2023-50927

    CVE-2023-50927

    Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.

    Published:Feb 14, 2024
    Last Modified:Apr 24, 2025
    EPS:Feb 14, 2024
    EPSS Score:0.00319
    CVSS Score:8.6

    Affected Products

    Vendor
    Contiki-ng
    Product
    Contiki-ng

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-5857 (CVSS 9.2) — Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before…
    CVE-2026-5856 (CVSS 7.1) — Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels wi…
    CVE-2026-5855 (CVSS 8.7) — Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied bu…
    CVE-2023-29001 (CVSS 8.7) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system…
    CVE-2024-41125 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-41126 (CVSS 8.3) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte…
    CVE-2024-47181 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can …
    CVE-2023-50926 (CVSS 7.5) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…
    CVE-2023-48229 (CVSS 7) — Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bound…
    CVE-2020-27634 (CVSS 9.1) — In Contiki 4.5, TCP ISNs are improperly random.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High