Paper/Archive/CVE-2023-23304

CVE-2023-23304

mitre — The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `T…

EPSS 0.6%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 49.3.493 × 209.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADP7.7CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refdeveloper.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html refgithub.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md