CVE-2024-23938

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

EPSS

0.94%

Published

Sep 28, 2024

Modified

Oct 3, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23184

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-121CWE-787

Affected Products (1)

silabs · gecko_osvulnerable

References (2)

https://community.silabs.com/a45Vm0000000Atp

Permissions Required

https://www.zerodayinitiative.com/advisories/ZDI-24-868/

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs