CVE-2023-24826

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-824

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248277.5syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password dis CVE-2023-248288.8Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and passwo CVE-2023-248298.8Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0 CVE-2023-248307.5Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13 CVE-2023-248319.8Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.1 CVE-2023-248327.5A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to cra CVE-2023-248337.5A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an a CVE-2023-248346.5WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exp CVE-2023-248357.2Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker CVE-2023-248368.8SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privi CVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user CVE-2023-248389.8HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain t