CVE-2023-50926

Summary

CVE-2023-50926 is a vulnerability affecting Contiki-NG, an open-source operating system for IoT devices. The issue arises from an incoming DIO message in the RPL-Lite implementation, which includes an unvalidated field specifying the length of an IPv6 address prefix. Malicious actors can exploit this by setting a value longer than the maximum prefix length, leading to an out-of-bounds read when the memcmp function is called. Contiki-NG users are advised to update to the latest release or manually apply the patch from pull request #2721 to mitigate this risk. The vulnerability has been fixed in the "develop" branch and is expected to be included in the next Contiki-NG release.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.