CVE-2021-32771

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Aug 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-327728.8Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious charactersCVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluateCVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no prCVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valuCVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on WinCVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when eCVE-2021-327787.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’CVE-2021-327798.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy CVE-2021-32789.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulneraCVE-2021-327807.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy CVE-2021-327817.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after CVE-2021-327825.4Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application