CVE-2024-23973 | THREATINT

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

PUBLISHED Reserved 2024-01-25 | Published 2025-01-30 | Updated 2025-08-26 | Assigner icscert

HIGH: 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-120

Product status

Default status

unaffected

all versions (semver)

affected

Credits

PCAutomotive reported this to ZDI. finder

References

www.zerodayinitiative.com/advisories/ZDI-24-873/

community.silabs.com/a45Vm0000000Atp

cve.org (CVE-2024-23973)

nvd.nist.gov (CVE-2024-23973)

Download JSON