Information Disclosure Vulnerability in Silicon Labs Gecko OS
CVE-2024-23937

4.3MEDIUM

Key Information:

Vendor

Silicon Labs

Status
Gecko Os
Vendor
CVE Published:
31 January 2025

What is CVE-2024-23937?

A flaw in the debug interface of Silicon Labs Gecko OS allows network-adjacent attackers to disclose sensitive information. This issue arises from inadequate validation of user-supplied strings as format specifiers. Attackers may exploit this vulnerability without requiring authentication and can potentially combine it with other weaknesses to execute arbitrary code within the device's context.

Affected Version(s)

Gecko OS all versions

References

https://www.zerodayinitiative.com/advisories/ZDI-24-869/
https://community.silabs.com/a45Vm0000000Atp

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.