{"id":"CVE-2023-23609","aliases":["EUVD-2023-27708","GHSA-qr4q-6h3m-h3g7"],"status":"published","title":"contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames","description":"Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the \"develop\" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00369,"percentile":0.31104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-01-25T06:15:34Z","modified":"2026-10-28T02:30:34Z","products":[{"vendor":"contiki-ng","product":"contiki-ng"}],"references":[{"url":"https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-qr4q-6h3m-h3g7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory"]},{"url":"https://github.com/contiki-ng/contiki-ng/pull/2254","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23609.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23609","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-23609","title":"contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames","description":"Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the \"develop\" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.","status":"published","published":"2023-01-25T06:15:34.128Z","modified":"2025-03-11T13:32:09.104Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:21.232549Z"}],"euvd":[{"id":"EUVD-2023-27708","description":"Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the \"develop\" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.","status":"published","published":"2023-01-25T06:15:34Z","modified":"2025-03-11T13:32:09Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:53:08.182954Z"}],"nvd":[{"id":"CVE-2023-23609","description":"Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the \"develop\" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.","status":"published","published":"2023-01-26T21:18:14.1Z","modified":"2026-06-17T05:37:34.493Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-23609","title":"contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames","description":"Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the \"develop\" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.","status":"published","published":"2023-01-25T06:15:34.128Z","modified":"2026-10-28T02:30:34.43240067Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:30.709518Z"}]}}