Arbitrary Code Execution Vulnerability in Silicon Labs Gecko OS

CVE-2024-24731

What is CVE-2024-24731?

A vulnerability exists in the Silicon Labs Gecko OS that allows network-adjacent attackers to execute arbitrary code. The flaw is tied to the mishandling of the http_download command, which does not adequately validate the length of user-supplied data before it is copied to a stack-based buffer. This oversight enables attackers to leverage the vulnerability without authentication, potentially yielding control over the affected device.

References