CVE-2022-41873

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. While processing the L2CAP protocol, the Bluetooth Low Energy stack of Contiki-NG needs to map an incoming channel ID to its metadata structure. While looking up the corresponding channel structure in get_channel_for_cid (in os/net/mac/ble/ble-l2cap.c), a bounds check is performed on the incoming channel ID, which is meant to ensure that the channel ID does not exceed the maximum number of supported channels.However, an integer truncation issue leads to only the lowest byte of the channel ID to be checked, which leads to an incomplete out-of-bounds check. A crafted channel ID leads to out-of-bounds memory to be read and written with attacker-controlled data. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. As a workaround, Users can apply the patch in Contiki-NG pull request 2081 on GitHub.

• CWE-125
• CWE-787
• CWE-125

• https://github.com/contiki-ng/contiki-ng/pull/2081Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-m5cj-fw8m-ffgfThird Party Advisory
• https://github.com/contiki-ng/contiki-ng/pull/2081Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-m5cj-fw8m-ffgfThird Party Advisory

Published

Nov 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41860In freeradius, when an EAP-SIM supplicant sends an unknown S…7.5
• CVE-2022-41861A flaw was found in freeradius. A malicious RADIUS client or…6.5
• CVE-2022-41862In PostgreSQL, a modified, unauthenticated server can send a…3.7
• CVE-2022-4187Insufficient policy enforcement in DevTools in Google Chrome…6.5
• CVE-2022-41870AP Manager in Innovaphone before 13r2 Service Release 17 all…7.2
• CVE-2022-41871SEPPmail through 12.1.17 allows command injection within the…8.8
• CVE-2022-41874Tauri is a framework for building binaries for all major des…4.7
• CVE-2022-41875A remote code execution (RCE) vulnerability in Optica allows…9.8
• CVE-2022-41876ezplatform-graphql is a GraphQL server implementation for Ib…5.3
• CVE-2022-41877FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-41878Parse Server is an open source backend that can be deployed …9.8
• CVE-2022-41879Parse Server is an open source backend that can be deployed …9.8