CVE-2023-23299

2023-05-2300:00:00

mitre

www.cve.org

garminos

tvm

permission bypass

vulnerability

ciq api

user profile information

gps coordinates

EPSS

0.001

Percentile

48.6%

JSON

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.