CVE-2021-32771— Buffer overflow in contiki-ng
Quick assessment
Affected
contiki-ng contiki-ng
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Contiki-NG是一套用于下一代IoT（物联网）设备的开源跨平台操作系统。 Contiki-NG 4.7及以前的版本存在安全漏洞，该漏洞源于攻击者在RPL-Classic实现中复制IPv6地址前缀时，可能会导致缓冲区溢出。触发该漏洞的前提是Contiki-NG系统必须加入RPL DODAG。在此之后，攻击者可以发送一个带有Target选项的DAO包（其中包含大于128位的前缀长度）。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-32771
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Buffer overflow in contiki-ng
Source: CVE Program / CVE List V5
Vulnerability Description
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)
Source: CVE Program / CVE List V5
Vulnerability Title
Contiki-NG 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Contiki-NG是一套用于下一代IoT（物联网）设备的开源跨平台操作系统。 Contiki-NG 4.7及以前的版本存在安全漏洞，该漏洞源于攻击者在RPL-Classic实现中复制IPv6地址前缀时，可能会导致缓冲区溢出。触发该漏洞的前提是Contiki-NG系统必须加入RPL DODAG。在此之后，攻击者可以发送一个带有Target选项的DAO包（其中包含大于128位的前缀长度）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| contiki-ng | contiki-ng | < 4.8 | - |
|
II. Public POCs for CVE-2021-32771
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-32771
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-32771 (1)
-
https://github.com/contiki-ng/contiki-ng/pull/1615 x_refsource_MISC
Other References for CVE-2021-32771 (1)
-
https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8 x_refsource_MISC
Same Patch Batch · contiki-ng · 2022-08-04 · 3 CVEs total
| CVE-2022-35927 | 8.1 HIGH | Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG |
| CVE-2022-35926 | 5.9 MEDIUM | Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG |
IV. Related Vulnerabilities
Same product: contiki-ng
-
CVE-2026-5857
Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic -
CVE-2026-5856
Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecke -
CVE-2026-5855
Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked -
CVE-2023-29001
Uncontrolled recursion due to insufficient validation of the -
CVE-2024-41125
Out-of-bounds read in SNMP when decoding a string in Contiki
Same vendor: contiki-ng
-
CVE-2026-5857
Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic -
CVE-2026-5856
Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecke -
CVE-2026-5855
Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked -
CVE-2023-29001
Uncontrolled recursion due to insufficient validation of the -
CVE-2024-41125
Out-of-bounds read in SNMP when decoding a string in Contiki
Same weakness: CWE-120
-
CVE-2026-78322
File-roller: file-roller: stack buffer overflow in parse_pro -
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk -
CVE-2026-71942
DrayTek VigorSwitch Multiple Models Buffer Overflow via mail -
CVE-2026-71941
DrayTek VigorSwitch Multiple Models Buffer Overflow via diag -
CVE-2026-71940
DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_
V. Comments for CVE-2021-32771
No comments yet