CVE-2023-33973
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame, leading to a NULL pointer dereference and crashing the device, resulting in denial of service.
Risk Assessment
This vulnerability can cause IoT devices to crash, potentially disrupting services within the organization. The lack of known workarounds increases the risk for users of these software versions.
Recommendation
It is recommended to update to the latest version of RIOT-OS to patch this vulnerability. Additionally, monitor devices for unauthorized attempts to send 6LoWPAN frames.
Other vulnerabilities in RIOT-OS network stack
See all- CVE-2023-33975Critical
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer.
- CVE-2023-33974High
RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device, triggering a race condition that leads to invalid memory access and denial of service.
Original NVD description (English source)
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. There are no known workarounds.