Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-47181— Unaligned memory access in RPL option processing in Contiki-NG

Quick assessment

Affected
contiki-ng contiki-ng
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Contiki-NG是Contiki-NG开源的一个适用于物联网中资源受限设备的操作系统。 Contiki-NG 4.9及之前版本存在代码问题漏洞，该漏洞源于RPL实现中存在未对齐内存访问问题，可能导致系统崩溃。

CVSS 7.5 · High EPSS 0.58% · P46
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-47181

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unaligned memory access in RPL option processing in Contiki-NG
Source: CVE Program / CVE List V5
Vulnerability Description
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of the Contiki-NG operating system. The problem can occur when either one of these RPL implementations is enabled and connected to an RPL instance. If an IPv6 packet containing an odd number of padded bytes before the RPL option, it can cause the rpl_ext_header_hbh_update function to read a 16-bit integer from an odd address. The impact of this unaligned read is architecture-dependent, but can potentially cause the system to crash. The problem has not been patched as of release 4.9, but will be included in the next release. One can apply the changes in Contiki-NG pull request #2962 to patch the system or wait for the next release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的类型转换
Source: CVE Program / CVE List V5
Vulnerability Title
Contiki-NG 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Contiki-NG是Contiki-NG开源的一个适用于物联网中资源受限设备的操作系统。 Contiki-NG 4.9及之前版本存在代码问题漏洞，该漏洞源于RPL实现中存在未对齐内存访问问题，可能导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
contiki-ng contiki-ng <= 4.9 -

II. Public POCs for CVE-2024-47181

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9626 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2024-47181

请登录查看更多情报信息。

Same Patch Batch · contiki-ng · 2024-11-27 · 4 CVEs total

CVE-2024-41125 8.4 HIGH Out-of-bounds read in SNMP when decoding a string in Contiki-NG
CVE-2024-41126 8.4 HIGH Out-of-bounds read when decoding SNMP messages in Contiki-NG
CVE-2023-29001 Uncontrolled recursion due to insufficient validation of the IPv6 source routing header in

IV. Related Vulnerabilities

Same product: contiki-ng
Same vendor: contiki-ng
Same weakness: CWE-704

V. Comments for CVE-2024-47181

No comments yet

Leave a comment