CVE-2023-24825

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-252 CWE-476

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248267.5RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prio CVE-2023-248277.5syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password dis CVE-2023-248288.8Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and passwo CVE-2023-248298.8Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0 CVE-2023-248307.5Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13 CVE-2023-248319.8Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.1 CVE-2023-248327.5A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra CVE-2023-248337.5A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a CVE-2023-248346.5WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exp CVE-2023-248357.2Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker CVE-2023-248368.8SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privi CVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user