Security readout for executives and security teams
Plain-English summary
A flaw in Contiki-NG can let a specially formed 6LoWPAN packet make an affected IoT device read beyond available packet data. That may expose memory and cause limited disruption. The issue matters most where Contiki-NG 4.6 or earlier is deployed in reachable IoT firmware.
Executive priority
Treat this as a high-priority IoT exposure issue where affected Contiki-NG devices are reachable. The business risk is strongest for confidentiality in constrained device environments, with some availability risk. Prioritize inventory, vendor confirmation, and patched firmware planning.
Technical view
CVE-2021-21410 is a CWE-125 out-of-bounds read in Contiki-NG IPv6 header decompression. The uncompress_hdr_iphc function lacked sufficient packet-buffer boundary checks when handling compressed 6LoWPAN traffic. Sources rate it CVSS 8.2 high, with high confidentiality impact, no integrity impact, and low availability impact.
Likely exposure
Organizations using Contiki-NG 4.6 or earlier in IoT devices that process 6LoWPAN packets. Exposure depends on deployed firmware, network reachability to the 6LoWPAN/IPv6 path, and whether downstream vendors embedded the affected code. No CPEs are listed in the bundle.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked KEV. The advisory states crafted 6LoWPAN packets can trigger the out-of-bounds read. Evidence is sufficient for vulnerability existence, but incomplete for real-world exploitation prevalence.
Researcher notes
Focus analysis on Contiki-NG 4.6 and prior, the 6LoWPAN decompression path, and whether the PR 1482 fix is present. Do not assume unrelated Contiki forks or products are affected without evidence. Sources state no patched release existed at original publication.
Mitigation direction
- Apply the Contiki-NG out-of-band patch referenced by the advisory and pull request.
- Check current Contiki-NG guidance for any later fixed release or vendor-specific firmware update.
- Prioritize affected devices reachable over 6LoWPAN or exposed IPv6 paths.
- Limit untrusted access to networks carrying 6LoWPAN traffic where operationally possible.
- Track downstream device vendors that ship Contiki-NG-based firmware.
Validation and detection
- Inventory firmware and SBOMs for Contiki-NG 4.6 or earlier.
- Confirm whether deployed devices process 6LoWPAN packets in production.
- Review source or vendor attestations for the advisory patch from pull request 1482.
- Verify compensating network controls restrict untrusted 6LoWPAN access.
- Check device telemetry for unexplained crashes or memory-read fault symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21410 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L3.94.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-hhwj-2p59-v8p9CVE reference · x_refsource_CONFIRM
- https://github.com/contiki-ng/contiki-ng/pull/1482CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.