CVE-2023-23300

2023-05-2300:00:00

mitre

www.cve.org

cve-2023-23300

ciq api

buffer overflow

data validation

malicious application

firmware hijack

9.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.9%

JSON

The Toybox.Cryptography.Cipher.initialize API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the device’s firmware.