CVE-2023-50927
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-50927 is a vulnerability affecting Contiki-NG, an open-source operating system for IoT devices. An out-of-bounds read issue exists in the RPL-Lite implementation of the RPL protocol. This vulnerability arises due to insufficient checks on the lengths of DIO and DAO messages containing RPL sub-option headers. An attacker can exploit this flaw to read memory outside of the intended boundaries. Users are strongly recommended to upgrade to Contiki-NG 4.9, as a patch has been released. Alternatively, users unable to upgrade can manually apply the code changes provided in PR #2484.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Contiki-NG
Affected Vendors
- Adam Dunkels