Lucene search

K
cvelistSilabsCVELIST:CVE-2023-4041
HistoryAug 23, 2023 - 4:09 a.m.

CVE-2023-4041 Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

2023-08-2304:09:12
CWE-494
CWE-787
CWE-120
Silabs
www.cve.org
6
silicon labs
arm
firmware update file parser
code injection
authentication bypass

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.002

Percentile

54.0%

Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects “Standalone” and “Application” versions of Gecko Bootloader.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Firmware Update File Parser"
    ],
    "platforms": [
      "ARM"
    ],
    "product": "Gecko Bootloader",
    "repo": "https://github.com/SiliconLabs/gecko_sdk/releases",
    "vendor": "Silicon Labs",
    "versions": [
      {
        "lessThan": "4.3.1",
        "status": "affected",
        "version": "0",
        "versionType": "4.3.1"
      },
      {
        "lessThan": "4.2.4",
        "status": "affected",
        "version": "0",
        "versionType": "4.2.4"
      },
      {
        "status": "unaffected",
        "version": "4.3.2"
      },
      {
        "status": "unaffected",
        "version": "4.2.4"
      }
    ]
  }
]

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.002

Percentile

54.0%

Related for CVELIST:CVE-2023-4041