{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T09:27:48.860","vulnerabilities":[{"cve":{"id":"CVE-2022-35927","sourceIdentifier":"security-advisories@github.com","published":"2022-08-04T21:15:08.103","lastModified":"2026-06-17T04:52:32.410","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue."},{"lang":"es","value":"Contiki-NG es un sistema operativo de código abierto y multiplataforma para dispositivos IoT. En la implementación del protocolo de enrutamiento RPL-Classic en el sistema operativo Contiki-NG, un mensaje de control DODAG Information Option (DIO) entrante puede contener una opción de información de prefijo con un parámetro de longitud. Sin embargo, el valor del parámetro de longitud no es comprobado, y es posible causar un desbordamiento del búfer cuando es copiado el prefijo en el set_ip_from_prefix function. Esta vulnerabilidad afecta a cualquiera ejecutando una versión de Contiki-NG anterior a 4.7 que pueda recibir mensajes RPL DIO de partes externas. Para obtener una versión parcheada, los usuarios deben actualizar a Contiki-NG versiones 4.7 o posteriores. No se presentan mitigaciones para este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"contiki-ng","product":"contiki-ng","versions":[{"version":"< 4.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:51:03.682591Z","id":"CVE-2022-35927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7","matchCriteriaId":"ABF8D9D8-767C-4040-9077-2CB8E5BFB008"}]}]}],"references":[{"url":"https://github.com/contiki-ng/contiki-ng/pull/1589","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wm","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/pull/1589","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wm","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}