What’s Vulnerable › Vulnerabilities

CVE-2023-50927: Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-14 · updated 2026-06-17
• Weakness: CWE-125

Description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.

Affected products

• contiki-ng: before 4.9 — fixed in 4.9

How to fix

Upgrade to a fixed version: contiki-ng 4.9. Check the vendor advisory for mitigations.

References

• https://github.com/contiki-ng/contiki-ng/pull/2484
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw
• https://github.com/contiki-ng/contiki-ng/pull/2484
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw

Get alerted when CVE-2023-50927 or the next vulnerability affects your stack