Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
77 results · page 1 of 2
Aug 6, 2026Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so CVE-2026-5857 · Other software · Contiki-NG · reported by VulnCheckCritical 9.2
Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.
- Product
- Contiki-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newCVE-2026-5856 · Other software · Contiki-NG · reported by VulnCheckHigh 7.1
Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.
- Product
- Contiki-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes froCVE-2026-5855 · Other software · Contiki-NG · reported by VulnCheckHigh 8.7
Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. Corrupted tlv_len derived from the out-of-bounds memory further corrupts the caller's parse offset. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
- Product
- Contiki-NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2024-47181 · Other software · contiki-ng · reported by GitHubHigh 7.5
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of the Contiki-NG operating system. The problem can occur when either one of these RPL implementations is enabled and connected to an RPL instance. If an IPv6 packet containing an odd number of padded bytes before the RPL option, it can cause the rpl_ext_header_hbh_update function to read a 16-bit integer from an odd address. The impact of this unaligned read is architecture-dependent, but can potentially cause the system to crash. The problem has not been patched as of release 4.9, but will be included in the next release. One can apply the changes in Contiki-NG pull request #2962 to patch the system or wait for the next release.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2024-41126 · Other software · contiki-ng · reported by GitHubHigh 8.3
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-message.c module, where the snmp_message_decode function fails to check the boundary of the message buffer when reading a byte from it immediately after decoding an object identifier (OID). The problem has been patched in Contiki-NG pull request 2937. It will be included in the next release of Contiki-NG. Users are advised to either apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2024-41125 · Other software · contiki-ng · reported by GitHubHigh 8.3
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The vulnerability exists in the os/net/app-layer/snmp/snmp-ber.c module, where the function snmp_ber_decode_string_len_buffer decodes the string length from a received SNMP packet. In one place, one byte is read from the buffer, without checking that the buffer has another byte available, leading to a possible out-of-bounds read. The problem has been patched in Contiki-NG pull request #2936. It will be included in the next release of Contiki-NG. Users are advised to apply the patch manually or to wait for the next release. A workaround is to disable the SNMP module in the Contiki-NG build configuration.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2023-29001 · Other software · contiki-ng · reported by GitHubHigh 8.7
Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its two alternative RPL protocol implementations. The IPv6 implementation uses the results of this processing to determine whether an incoming packet should be forwarded to another host. Because of missing validation of the resulting next-hop address, an uncontrolled recursion may occur in the tcpip_ipv6_output function in the os/net/ipv6/tcpip.c module when receiving a packet with a next-hop address that is a local address. Attackers that have the possibility to send IPv6 packets to the Contiki-NG host can therefore trigger deeply nested recursive calls, which can cause a stack overflow. The vulnerability has not been patched in the current release of Contiki-NG, but is expected to be patched in the next release. The problem can be fixed by applying the patch in Contiki-NG pull request #2264. Users are advised to either apply the patch manually or to wait for the next release. There are no known workarounds for this vulnerability.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2023-50927 · Other software · contiki-ng · reported by GitHubHigh 8.6
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2023-50926 · Other software · contiki-ng · reported by GitHubHigh 7.5
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2024Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2023-48229 · Other software · contiki-ng · reported by GitHubHigh 7
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 radios on nRF platforms in the Contiki-NG operating system. The problem is triggered when parsing radio frames in the `read_frame` function in the `arch/cpu/nrf/net/nrf-ieee-driver-arch.c` module. More specifically, the `read_frame` function performs an incomplete validation of the payload length of the packet, which is a value that can be set by an external party that sends radio packets to a Contiki-NG system. Although the value is validated to be in the range of the MTU length, it is not validated to fit into the given buffer into which the packet will be copied. The problem has been patched in the "develop" branch of Contiki-NG and is expected to be included in subsequent releases. Users are advised to update their develop branch or to update to a subsequent release when available. Users unable to upgrade should consider manually applying the changes in PR #2741.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2024Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denialCVE-2021-42147 · Other software · Contiki-ng · reported by MITRECritical 9.1
Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denial of service via crafted data packet.
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 24, 2024An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.CVE-2021-42146 · Other software · Contiki-ng · reported by MITREHigh 7.5
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 24, 2024An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of serCVE-2021-42145 · Other software · Contiki-ng · reported by MITREHigh 7.5
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 24, 2024Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_CVE-2021-42144 · Other software · Contiki-ng · reported by MITRECritical 9.8
Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message().
- Product
- Contiki-ng Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 24, 2024An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.CVE-2021-42143 · Other software · Contiki-ng · reported by MITRECritical 9.1
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 23, 2024An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.CVE-2021-42142 · Other software · Contiki-ng · reported by MITRECritical 9.8
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comseclists.org
Jan 22, 2024An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30.CVE-2021-42141 · Other software · Contiki-ng · reported by MITRECritical 9.8
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of service.
- Product
- Tinydtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 10, 2023In Contiki 4.5, TCP ISNs are improperly random.CVE-2020-27634 · Other software · Contiki-ng · reported by MITRECritical 9.1
In Contiki 4.5, TCP ISNs are improperly random.
- Product
- Contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Contiki-NG is an operating system for internet-of-things devices.CVE-2023-37459 · Other software · contiki-ng · reported by GitHubMedium 5.3
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Contiki-NG is an operating system for internet-of-things devices.CVE-2023-37281 · Other software · contiki-ng · reported by GitHubMedium 5.3
Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header decompression, Contiki-NG confirms the received packet buffer contains enough data as needed for that field. But no similar check is done before decompressing the IPv6 address. Therefore, up to 16 bytes can be read out of bounds on the line with the statement `memcpy(&ipaddr->u8[16 - postcount], iphc_ptr, postcount);`. The value of `postcount` depends on the address compression used in the received packet and can be controlled by the attacker. As a result, an attacker can inject a packet that causes an out-of-bound read. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2509 to patch the system.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023Contiki-NG is an operating system for internet of things devices.CVE-2023-34101 · Other software · contiki-ng · reported by GitHubHigh 7.3
Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the Contiki-NG OS does not verify that the packet buffer is big enough to contain the bytes it needs before accessing them. Up to 16 bytes can be read out of bounds in the `dao_input_storing` function. An attacker can truncate an ICMP packet so that it does not contain enough data, leading to an out-of-bounds read on these lines. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. As a workaround, one can apply the changes in Contiki-NG pull request #2435 to patch the system.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2023Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2023-34100 · Other software · contiki-ng · reported by GitHubHigh 7.3
Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS does not verify that certain buffer indices to read from are within the bounds of the IPv6 packet buffer, uip_buf. In particular, there is a 2-byte buffer read in the module os/net/ipv6/uip6.c. The buffer is indexed using 'UIP_IPTCPH_LEN + 2 + c' and 'UIP_IPTCPH_LEN + 3 + c', but the uip_buf buffer may not have enough data, resulting in a 2-byte read out of bounds. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. Users are advised to watch for the 4.9 release and to upgrade when it becomes available. There are no workarounds for this vulnerability aside from manually patching with the diff in commit `cde4e9839`.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiationCVE-2023-31129 · Other software · contiki-ng · reported by GitHubHigh 7.5
The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiations. Contiki-NG contains an implementation of IPv6 Neighbor Discovery (ND) in the module `os/net/ipv6/uip-nd6.c`. The ND protocol includes a message type called Router Solicitation (RS), which is used to locate routers and update their address information via the SLLAO (Source Link-Layer Address Option). If the indicated source address changes, a given neighbor entry is set to the STALE state. The message handler does not check for RS messages with an SLLAO that indicates a link-layer address change that a neighbor entry can actually be created for the indicated address. The resulting pointer is used without a check, leading to the dereference of a NULL pointer of type `uip_ds6_nbr_t`. The problem has been patched in the `develop` branch of Contiki-NG, and will be included in the upcoming 4.9 release. As a workaround, users can apply Contiki-NG pull request #2271 to patch the problem directly.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Contiki-NG is an operating system for Internet of Things devices.CVE-2023-30546 · Other software · contiki-ng · reported by GitHubCritical 9.8
Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contiki-NG operating system in versions 4.8 and prior. The problem exists in the Contiki File System (CFS) backend for the storage of data (file os/storage/antelope/storage-cfs.c). In the functions `storage_get_index` and `storage_put_index`, a buffer for merging two strings is allocated with one byte less than the maximum size of the merged strings, causing subsequent function calls to the cfs_open function to read from memory beyond the buffer size. The vulnerability has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. As a workaround, the problem can be fixed by applying the patch in Contiki-NG pull request #2425.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2023Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices.CVE-2023-28116 · Other software · contiki-ng · reported by GitHubHigh 8.1
Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices. In versions 4.8 and prior, an out-of-bounds write can occur in the BLE L2CAP module of the Contiki-NG operating system. The network stack of Contiki-NG uses a global buffer (packetbuf) for processing of packets, with the size of PACKETBUF_SIZE. In particular, when using the BLE L2CAP module with the default configuration, the PACKETBUF_SIZE value becomes larger then the actual size of the packetbuf. When large packets are processed by the L2CAP module, a buffer overflow can therefore occur when copying the packet data to the packetbuf. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. The problem can be worked around by applying the patch manually.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2023-23609 · Other software · contiki-ng · reported by GitHubHigh 8.2
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2022-41972 · Other software · contiki-ng · reported by GitHubLow 2.9
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in this stack, which causes the implementation to dereference a NULL pointer and triggers undefined behavior. More specifically, while processing the L2CAP protocol, the implementation maps an incoming channel ID to its metadata structure. In this structure, state information regarding credits is managed through calls to the function input_l2cap_credit in the module os/net/mac/ble/ble-l2cap.c. Unfortunately, the input_l2cap_credit function does not check that the metadata corresponding to the user-supplied channel ID actually exists, which can lead to the channel variable being set to NULL before a pointer dereferencing operation is performed. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. Users can apply the patch in Contiki-NG pull request #2253 as a workaround until the new package is released.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2022Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2022-41873 · Other software · contiki-ng · reported by GitHubMedium 4.2
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. While processing the L2CAP protocol, the Bluetooth Low Energy stack of Contiki-NG needs to map an incoming channel ID to its metadata structure. While looking up the corresponding channel structure in get_channel_for_cid (in os/net/mac/ble/ble-l2cap.c), a bounds check is performed on the incoming channel ID, which is meant to ensure that the channel ID does not exceed the maximum number of supported channels.However, an integer truncation issue leads to only the lowest byte of the channel ID to be checked, which leads to an incomplete out-of-bounds check. A crafted channel ID leads to out-of-bounds memory to be read and written with attacker-controlled data. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. As a workaround, Users can apply the patch in Contiki-NG pull request 2081 on GitHub.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2022-36054 · Other software · contiki-ng · reported by GitHubMedium 6.8
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2022-36053 · Other software · contiki-ng · reported by GitHubMedium 5.9
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer module (os/net/ipv6/uipbuf.c) that processes IPv6 extension headers in incoming data packets. As part of this processing, the function uipbuf_get_next_header casts a pointer to a uip_ext_hdr structure into the packet buffer at different offsets where extension headers are expected to be found, and then reads from this structure. Because of a lack of bounds checking, the casting can be done so that the structure extends beyond the packet's end. Hence, with a carefully crafted packet, it is possible to cause the Contiki-NG system to read data outside the packet buffer. A patch that fixes the vulnerability is included in Contiki-NG 4.8.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2022-36052 · Other software · contiki-ng · reported by GitHubMedium 5.9
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may cast a UDP header structure at a certain offset in a packet buffer. The code does not check whether the packet buffer is large enough to fit a full UDP header structure from the offset where the casting is made. Hence, it is possible to cause an out-of-bounds read beyond the packet buffer. The problem affects anyone running devices with Contiki-NG versions previous to 4.8, and which may receive 6LoWPAN packets from external parties. The problem has been patched in Contiki-NG version 4.8.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2022-35927 · Other software · contiki-ng · reported by GitHubHigh 8.1
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2022-35926 · Other software · contiki-ng · reported by GitHubMedium 5.9
Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option header and the Source Link-Layer Address Option (SLLAO). This attack requires ipv6 be enabled for the network. The problem has been patched in the develop branch of Contiki-NG. The upcoming 4.8 release of Contiki-NG will include the patch.Users unable to upgrade may apply the patch in Contiki-NG PR #1654.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022Contiki-NG is an open-source, cross-platform operating system for IoT devices.CVE-2021-32771 · Other software · contiki-ng · reported by GitHubHigh 8.1
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP CVE-2020-12140 · Other software · Contiki-ng · reported by MITREHigh 8.8
A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP frames.
- Product
- Contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via cCVE-2020-12141 · Other software · Contiki-ng · reported by MITRECritical 9.1
An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via crafted SNMP packets to snmp_ber_decode_string_len_buffer in os/net/app-layer/snmp/snmp-ber.c.
- Product
- Contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2021In Contiki 3.0, Telnet option negotiation is mishandled.CVE-2021-40523 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting foreverCVE-2021-38387 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting forever, which may cause excessive CPU consumption.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directoCVE-2021-38386 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directory has many files with long names.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service.CVE-2021-38311 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices.CVE-2021-21410 · Other software · contiki-ng · reported by GitHubHigh 8.2
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not perform proper boundary checks when reading from the packet buffer. Hence, it is possible to construct a compressed 6LoWPAN packet that will read more bytes than what is available from the packet buffer. As of time of publication, there is not a release with a patch available. Users can apply the patch for this vulnerability out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for internet of things devices.CVE-2021-21281 · Other software · contiki-ng · reported by GitHubHigh 7
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data offset that is unvalidated. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for internet of things devices.CVE-2021-21280 · Other software · contiki-ng · reported by GitHubHigh 8.6
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checked to be within the available space, thereby making it possible to write outside the buffer. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for internet of things devices.CVE-2021-21279 · Other software · contiki-ng · reported by GitHubHigh 7.5
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation (NS) messages. This type of attack can effectively shut down the operation of the system because of the cooperative scheduling used for the main parts of Contiki-NG and its communication stack. The problem has been patched in Contiki-NG 4.6. Users can apply the patch for this vulnerability out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for internet of things devices.CVE-2021-21257 · Other software · contiki-ng · reported by GitHubHigh 8.2
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an attacker to cause out-of-bounds writes with packets injected into the network stack. Specifically, the problem lies in the rpl_ext_header_srh_update function in the two rpl-ext-header.c modules for RPL-Classic and RPL-Lite respectively. The addr_ptr variable is calculated using an unvalidated CMPR field value from the source routing header. An out-of-bounds write can be triggered on line 151 in os/net/routing/rpl-lite/rpl-ext-header.c and line 261 in os/net/routing/rpl-classic/rpl-ext-header.c, which contain the following memcpy call with addr_ptr as destination. The problem has been patched in Contiki-NG 4.6. Users can apply a patch out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021Contiki-NG is an open-source, cross-platform operating system for internet of things devices.CVE-2021-21282 · Other software · contiki-ng · reported by GitHubHigh 8.6
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In versions prior to 4.5, buffer overflow can be triggered by an input packet when using either of Contiki-NG's two RPL implementations in source-routing mode. The problem has been patched in Contiki-NG 4.5. Users can apply the patch for this vulnerability out-of-band as a workaround.
- Product
- contiki-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021An issue was discovered in Contiki through 3.0.CVE-2021-28362 · Other software · Contiki-os · reported by MITREHigh 7.5
An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG.CVE-2020-24335 · Other software · UIP Project · reported by MITREHigh 7.5
An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
- Product
- UIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020An issue was discovered in the IPv6 stack in Contiki through 3.0.CVE-2020-25112 · Other software · Contiki-os · reported by MITRECritical 9.8
An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.
- Product
- Contiki-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Dec 11, 2020An issue was discovered in the IPv6 stack in Contiki through 3.0.CVE-2020-25111 · Other software · Contiki-os · reported by MITRECritical 9.8
An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.
- Product
- Contiki-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.