CVE-2023-50927 - CVE House

Back to Database

Status published High CVE-2023-50927

Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG

8.6 CVSS

Vulnerability Description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-50927

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from contiki-ng

View All →

Unaligned memory access in RPL option processing in Contiki-NG

Out-of-bounds read when decoding SNMP messages in Contiki-NG

Out-of-bounds read in SNMP when decoding a string in Contiki-NG

Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG

Out-of-bounds write in the radio driver for Contiki-NG nRF platforms

Affected Vendor

contiki-ng

View all reports →

Affected Software

contiki-ng

Vulnerable Versions:

< 4.9

Timeline

Official Publish: February 14th, 2024

Last Modified: April 24th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1003 OS Credential Dumping

Credential Access

T1552 Unsecured Credentials

Credential Access