Is CVE-2023-23609 actively exploited?

No active exploitation of CVE-2023-23609 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-23609 be exploited remotely?

Partially. CVE-2023-23609 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2023-23609?

CVE-2023-23609 has a CVSS score of 7.4 (HIGH).

HOME VULNERABILITIESCVE-2023-23609

HIGH

CVE-2023-23609

CWE-787Published: January 26, 2023· Updated: Jun 17, 2026

7.4

CVSS v3.1

Official Description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-bounds write that can occur in the BLE-L2CAP module. The Bluetooth Low Energy - Logical Link Control and Adaptation Layer Protocol (BLE-L2CAP) module handles fragmentation of packets up the configured MTU size. When fragments are reassembled, they are stored in a packet buffer of a configurable size, but there is no check to verify that the packet buffer is large enough to hold the reassembled packet. In Contiki-NG's default configuration, it is possible that an out-of-bounds write of up to 1152 bytes occurs. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. The problem can be fixed by applying the patch in Contiki-NG pull request #2254 prior to the release of version 4.9.

NVD Source

Technical Analysis

CVE-2023-23609 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.4.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.