CVE-2023-23306

CVE-2023-23306 affects Garmin Connect IQ (CIQ) API: Toybox.Ant.BurstPayload.add in CIQ API versions 2.2.0 through 4.1.7 suffers a type confusion leading to an out-of-bounds write. A malicious app could craft a Toybox.Ant.BurstPayload object, call add, override arbitrary memory, and hijack firmwar...

PT-2023-18897 · Ciq Api · Ciq Api

Name of the Vulnerable Software and Affected Versions: CIQ API versions 1.2.0 through 4.1.7 Description: The Toybox.GenericChannel.setDeviceConfig API method does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call t...

CVE-2023-23305

The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware...

CVE-2023-23302

The Toybox.GenericChannel.setDeviceConfig API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the executi...

CVE-2023-23298

The Toybox.Graphics.BufferedBitmap.initialize API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters...

CVE-2023-23304

The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the Toybox.SensorHistory module without permission. A malicious application could call any functions from the Toybox.SensorHistory module without the user's consent a...

CVE-2023-23304

The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the Toybox.SensorHistory module without permission. A malicious application could call any functions from the Toybox.SensorHistory module without the user's consent a...

CVE-2023-23300

The Toybox.Cryptography.Cipher.initialize API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the...

CVE-2023-23300

The Toybox.Cryptography.Cipher.initialize API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the...

PT-2023-18896 · Garmin · Ciq Api

Name of the Vulnerable Software and Affected Versions: CIQ API versions 1.0.0 through 4.1.7 Description: The issue arises from the news MonkeyC operation code in the CIQ API, which fails to properly check string resources, allowing them to extend past the expected sections. A malicious CIQ...

CVE-2023-23299

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

CVE-2023-23300

The CVE concerns Garmin Connect IQ (CIQ): Toybox.Cryptography.Cipher.initialize in CIQ API versions 3.0.0–4.1.7 does not validate parameters, enabling buffer overflows when copying data. This could let a malicious app hijack firmware execution (high risk, per CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H...

CVE-2023-23298

The CVE-2023-23298 issue affects Garmin CIQ API: Toybox.Graphics.BufferedBitmap.initialize at CIQ API versions 2.3.0 through 4.1.7. Root cause is lack of parameter validation that can trigger integer overflows during bitmap buffer allocation, potentially allowing malicious input to hijack firmwar...

CVE-2023-23303

The CVE-2023-23303 vulnerability affects Garmin Connect IQ CIQ API (Toybox.Ant.GenericChannel.enableEncryption) across versions 3.2.0–4.1.7. The issue arises because the API does not validate its parameter, enabling buffer overflows when copying various attributes. A malicious application could c...

CVE-2023-23299

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data...

CVE-2023-23304

The CVE-2023-23304 entry concerns GarminOS CIQ/TVM (Garmin Connect IQ): CIQ API versions 2.1.0 through 4.1.7 allow a specially crafted head section to access the Toybox.SensorHistory module without user consent, enabling a malicious app to call functions in that module and potentially disclose pr...

CVE-2023-23303

The Toybox.Ant.GenericChannel.enableEncryption API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the...

CVE-2023-23298: Integer Overflow or Wraparound

The Toybox.Graphics.BufferedBitmap.initialize API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer overflows when allocating the underlying bitmap buffer. A malicious application could call the API method with specially crafted parameters...

CVE-2023-23300: Buffer Copy without Checking Size of Input

The Toybox.Cryptography.Cipher.initialize API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overflows when copying data. A malicious application could call the API method with specially crafted parameters and hijack the execution of the...

CVE-2023-23304: Incorrect Authorization

The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the Toybox.SensorHistory module without permission. A malicious application could call any functions from the Toybox.SensorHistory module without the user's consent a...