CVE-2024-23937 - Silicon Labs Gecko OS Debug Interface Format String

Back Back to CVE browser

MEDIUM

Silicon Labs Gecko OS Debug Interface Format String

Published Jan 31, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.

Affected products

Vendor Silicon Labs Product Gecko OS Default
unaffected
- Version
  all versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Silicon Labs

Gecko OS

unaffected

Version	Status	Constraints
all versions	affected	-

Remediation

Vendor solution

Silicon Labs has issued an update to correct this vulnerability. More details can be found at: https://community.silabs.com/a45Vm0000000Atp

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://community.silabs.com/a45Vm0000000Atp
Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21367
Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-869/
Third Party Advisory

Link	Providers	Tags
https://community.silabs.com/a45Vm0000000Atp		Permissions Required
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21367		Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-869/		Third Party Advisory