CVE-2022-36054

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (file os/net/ipv6/sicslowpan.c) contains an input function that processes incoming packets and copies them into a packet buffer. Because of a missing length check in the input function, it is possible to write outside the packet buffer's boundary. The vulnerability can be exploited by anyone who has the possibility to send 6LoWPAN packets to a Contiki-NG system. In particular, the vulnerability is exposed when sending either of two types of 6LoWPAN packets: an unfragmented packet or the first fragment of a fragmented packet. If the packet is sufficiently large, a subsequent memory copy will cause an out-of-bounds write with data supplied by the attacker.

• CWE-787

• https://github.com/contiki-ng/contiki-ng/pull/1648Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-c36p-vhwg-244cThird Party Advisory
• https://github.com/contiki-ng/contiki-ng/pull/1648Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-c36p-vhwg-244cThird Party Advisory

Published

Sep 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36048Zulip is an open-source team collaboration tool with topic-b…4.3
• CVE-2022-36049Flux2 is a tool for keeping Kubernetes clusters in sync with…7.5
• CVE-2022-3605The WP CSV Exporter WordPress plugin before 1.3.7 does not p…7.8
• CVE-2022-36051ZITADEL combines the ease of Auth0 and the versatility of Ke…8.8
• CVE-2022-36052Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36053Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36055Helm is a tool for managing Charts. Charts are packages of p…6.5
• CVE-2022-36056Cosign is a project under the sigstore organization which ai…5.5
• CVE-2022-36057Discourse-Chat is an asynchronous messaging plugin for the D…4.8
• CVE-2022-36058Elrond go is the go implementation for the Elrond Network pr…7.5
• CVE-2022-36059matrix-js-sdk is a Matrix messaging protocol Client-Server S…5.3
• CVE-2022-3606A vulnerability was found in Linux Kernel. It has been class…5.5