CVE-2023-24825

RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.

• CWE-252
• CWE-476
• CWE-252
• CWE-476

• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761Mailing List
• https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169Vendor Advisory
• https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897Patch, Vendor Advisory
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729Vendor Advisory
• https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761Mailing List
• https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169Vendor Advisory
• https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897Patch, Vendor Advisory
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2Vendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2482The Responsive CSS EDITOR WordPress plugin through 1.0 does …7.2
• CVE-2023-24820RIOT-OS, an operating system that supports Internet of Thing…7.5
• CVE-2023-24821RIOT-OS, an operating system that supports Internet of Thing…7.5
• CVE-2023-24822RIOT-OS, an operating system that supports Internet of Thing…7.5
• CVE-2023-24823RIOT-OS, an operating system that supports Internet of Thing…9.8
• CVE-2023-24824cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-24826RIOT-OS, an operating system for Internet of Things (IoT) de…7.5
• CVE-2023-24827syft is a a CLI tool and Go library for generating a Softwar…7.5
• CVE-2023-24828Onedev is a self-hosted Git Server with CI/CD and Kanban. In…8.8
• CVE-2023-24829Incorrect Authorization vulnerability in Apache Software Fou…8.8
• CVE-2023-2483Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-24830Improper Authentication vulnerability in Apache Software Fou…7.5