CVE-2024-24731 | THREATINT

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the http_download command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

PUBLISHED Reserved 2024-01-27 | Published 2025-01-30 | Updated 2025-08-27 | Assigner icscert

HIGH: 7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-120

Product status

Default status

unaffected

all versions (semver)

affected

Credits

Connor Ford reported to ZDI. finder

References

www.zerodayinitiative.com/advisories/ZDI-24-870/

community.silabs.com/a45Vm0000000Atp

cve.org (CVE-2024-24731)

nvd.nist.gov (CVE-2024-24731)

Download JSON