CVE-2023-50926

Summary

CVE-2023-50926 is a vulnerability affecting Contiki-NG, an open-source operating system for IoT devices. An out-of-bounds read can occur when processing DIO messages using the RPL-Lite implementation. The issue stems from the lack of validation of the length field in the prefix information of the DIO message. An attacker can exploit this by setting a value longer than the maximum prefix length, leading to an out-of-bounds read during a memcmp function call. Users are urged to update to the patched version, available in Contiki-NG's "develop" branch, or manually apply the changes from pull request #2721.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.