contiki-ng vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-5857 Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so Critical 9.2 · Aug 6, 2026
• CVE-2026-5856 Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newHigh 7.1 · Aug 6, 2026
• CVE-2026-5855 Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes froHigh 8.7 · Aug 6, 2026
• CVE-2024-47181 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 7.5 · Nov 27, 2024
• CVE-2024-41126 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 8.3 · Nov 27, 2024
• CVE-2024-41125 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 8.3 · Nov 27, 2024
• CVE-2023-29001 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 8.7 · Nov 27, 2024
• CVE-2023-50927 Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.High 8.6 · Feb 14, 2024
• CVE-2023-50926 Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.High 7.5 · Feb 14, 2024
• CVE-2023-48229 Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.High 7 · Feb 14, 2024
• CVE-2021-42147 Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denialCritical 9.1 · Jan 24, 2024
• CVE-2021-42146 An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.High 7.5 · Jan 24, 2024
• CVE-2021-42145 An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of serHigh 7.5 · Jan 24, 2024
• CVE-2021-42144 Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_Critical 9.8 · Jan 24, 2024
• CVE-2021-42143 An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.Critical 9.1 · Jan 24, 2024
• CVE-2021-42142 An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.Critical 9.8 · Jan 23, 2024
• CVE-2021-42141 An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30.Critical 9.8 · Jan 22, 2024
• CVE-2020-27634 In Contiki 4.5, TCP ISNs are improperly random.Critical 9.1 · Oct 10, 2023
• CVE-2023-34101 Contiki-NG is an operating system for internet of things devices.High 7.3 · Jun 14, 2023
• CVE-2023-34100 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 7.3 · Jun 9, 2023
• CVE-2023-31129 The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiationHigh 7.5 · May 8, 2023
• CVE-2023-30546 Contiki-NG is an operating system for Internet of Things devices.Critical 9.8 · Apr 26, 2023
• CVE-2023-28116 Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices.High 8.1 · Mar 17, 2023
• CVE-2023-23609 Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.High 8.2 · Jan 26, 2023
• CVE-2022-35927 Contiki-NG is an open-source, cross-platform operating system for IoT devices.High 8.1 · Aug 4, 2022