by Kastro
Paper/Archive/CVE-2023-45318

CVE-2023-45318

Silicon Labs Gecko Platform — A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004.

EPSS 2%public exploitCVSS 10.0
critical.is priorityof 100
56
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 77.8.778 × 2015.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Gecko PlatformSilicon Labs Gecko Platform 4.3.2.0–CNA
uC-HTTPgit commit 80d4004–CNA
gecko_platform4.3.2.0–CISA-ADP
uc-httpgit commit 80d4004–CISA-ADP

Scores by source

talos (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2023-1843reftalosintelligence.com/vulnerability_reports/TALOS-2023-1843