Arbitrary Code Execution Vulnerability in Silicon Labs Gecko OS
CVE-2024-24731

7.5HIGH

Key Information:

Vendor

Silicon Labs

Status
Gecko Os
Vendor
CVE Published:
31 January 2025

What is CVE-2024-24731?

A vulnerability exists in the Silicon Labs Gecko OS that allows network-adjacent attackers to execute arbitrary code. The flaw is tied to the mishandling of the http_download command, which does not adequately validate the length of user-supplied data before it is copied to a stack-based buffer. This oversight enables attackers to leverage the vulnerability without authentication, potentially yielding control over the affected device.

Affected Version(s)

Gecko OS all versions

References

https://www.zerodayinitiative.com/advisories/ZDI-24-870/
https://community.silabs.com/a45Vm0000000Atp

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.