CVE-2023-50927 Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG

High 8.6 Published 14 Feb 2024 Updated 24 Apr 2025

Attackers can trigger out-of-bounds reads in Contiki-NG's RPL-Lite implementation via crafted DIO and DAO messages, potentially causing crashes or information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-50927?

CVE-2023-50927 is a high-severity memory corruption vulnerability in contiki-ng, published on 14 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484.

Weakness: CWE-125

Which versions are affected by CVE-2023-50927?

It affects 1 product.

Products include Contiki-Ng Contiki-Ng.

How do I fix CVE-2023-50927?

No fix has been published for CVE-2023-50927 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-50927 being exploited?

There is no known exploitation of CVE-2023-50927 in the wild and no public exploit code.

Sources

Also known as GHSA-9423-rgj4-wjfw.