Arbitrary Code Execution Vulnerability in Alpine Halo9 Devices

CVE-2024-23963

What is CVE-2024-23963?

A serious vulnerability exists in Alpine Halo9 devices that allows network-adjacent attackers to execute arbitrary code. This flaw is rooted in the PBAP_DecodeVCARD function, which fails to adequately validate the size of user-supplied data before copying it to a stack-based buffer. By leveraging this oversight, an attacker who can successfully pair a malicious Bluetooth device with the affected system can execute code with root privileges, potentially compromising the integrity and security of the device.

References