{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T06:38:18.458","vulnerabilities":[{"cve":{"id":"CVE-2023-37459","sourceIdentifier":"security-advisories@github.com","published":"2023-09-15T20:15:08.650","lastModified":"2026-06-17T06:08:15.633","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts to start the periodic TCP timer if it is a TCP packet with the SYN flag set. But the implementation does not first verify that a full TCP header has been received. Specifically, the implementation attempts to access the flags field from the TCP buffer in the following conditional expression in the `check_for_tcp_syn` function. For this reason, an attacker can inject a truncated TCP packet, which will lead to an out-of-bound read from the packet buffer. As of time of publication, a patched version is not available. As a workaround, one can apply the changes in Contiki-NG pull request #2510 to patch the system."},{"lang":"es","value":"Contiki-NG es un sistema operativo para dispositivos de Internet de las cosas. En las versiones 4.9 y anteriores, cuando se recibe un paquete, la pila de red Contiki-NG intenta iniciar el temporizador TCP periódico si se trata de un paquete TCP con el indicador SYN configurado. Pero la implementación no verifica primero que se haya recibido un encabezado TCP completo. Específicamente, la implementación intenta acceder al campo de banderas desde el búfer TCP en la siguiente expresión condicional en la función `check_for_tcp_syn`. Por este motivo, un atacante puede inyectar un paquete TCP truncado, lo que provocará una lectura fuera de los límites del búfer de paquetes. Al momento de la publicación, no hay una versión parcheada disponible. Como workaround, se pueden aplicar los cambios en la solicitud de extracción #2510 de Contiki-NG para parchear el sistema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"contiki-ng","product":"contiki-ng","versions":[{"version":"<= 4.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-25T18:03:53.467111Z","id":"CVE-2023-37459","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*","versionEndIncluding":"4.9","matchCriteriaId":"5ECE789E-8C10-42CB-BD98-A301AC471904"}]}]}],"references":[{"url":"https://github.com/contiki-ng/contiki-ng/pull/2510","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/pull/2510","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-6648-m23r-hq8c","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}