IM
IronMonkey Threat Research

CVE-2023-4041 CRITICAL

Published: 2023-08-23 | Last Modified: 2024-11-21 | Status: Modified

Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-120
en CWE-787
en CWE-913
[email protected] Primary
en CWE-120
en CWE-494
en CWE-787

Affected Products

Vendor Product Version Update Type
silabs gecko_bootloader * <built-in method update of dict object at 0x746527327ec0> Application
silabs gecko_bootloader * <built-in method update of dict object at 0x746527288b40> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:*
Yes cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:*

References