Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-32771 Details

Description

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have joined an RPL DODAG. After that, an attacker can send a DAO packet with a Target option that contains a prefix length larger than 128 bits. The problem was fixed after the release of Contiki-NG 4.7. Users unable to upgrade may apply the patch in Contiki-NG PR #1615.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/contiki-ng/contiki-ng/pull/1615	CVE	PatchThird Party Advisory
https://github.com/contiki-ng/contiki-ng/pull/1615/commits/587ae59956e00316fd44fd7072ac3a6a07b4b20f	CVE	PatchThird Party Advisory
https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8	CVE	Third Party Advisory
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jqjf-v7v9-xp6w	CVE	Third Party Advisory
https://github.com/contiki-ng/contiki-ng/pull/1615	[email protected]	PatchThird Party Advisory
https://github.com/contiki-ng/contiki-ng/pull/1615/commits/587ae59956e00316fd44fd7072ac3a6a07b4b20f	[email protected]	PatchThird Party Advisory
https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8	[email protected]	Third Party Advisory
https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jqjf-v7v9-xp6w	[email protected]	Third Party Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	[email protected]

Affected Products

Product	Versions
contiki-ng contiki-ng	< 4.8
CPE cpe:2.3:o:contiki-ng:contiki-ng:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 10, 2022	Initial Analysis	[email protected]