Out-of-Bounds Write Vulnerability in Weston Embedded uC-HTTP by Weston
CVE-2023-24585

7.7HIGH

Key Information:

Vendor: Silicon Labs
Status: Gecko Platform; Cesium Net; Uc-http
Vendor: CVE Published:; 14 November 2023

🔔 Create Silicon Labs Vulnerability Alert

What is CVE-2023-24585?

An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. This vulnerability can be exploited by sending specially crafted network packets, leading to potential memory corruption. Attackers can utilize this flaw to disrupt service or execute arbitrary code, making it critical for users to apply necessary mitigations and updates.

Affected Version(s)

Cesium NET 3.07.01

Gecko Platform 4.3.1.0

uC-HTTP v3.01.01

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:

7.7

Severity:

HIGH

Confidentiality:

Low

Integrity:

High

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 14, 2023
Vulnerability Reserved
Feb 13, 2023

Credit

Discovered by Kelly Leuschner of Cisco Talos.