CVE-2024-23937: (Pwn2Own) Silicon Labs Gecko OS Debug Interface Format String Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23937?
CVE-2024-23937 has been rated as a high-severity vulnerability due to its potential to disclose sensitive information without requiring authentication.
How do I fix CVE-2024-23937?
To mitigate CVE-2024-23937, it is recommended to update to the latest patched version of Silicon Labs Gecko OS as soon as it becomes available.
Who is affected by CVE-2024-23937?
CVE-2024-23937 affects installations of Silicon Labs Gecko OS that use the debug interface.
What type of attack is possible with CVE-2024-23937?
CVE-2024-23937 allows network-adjacent attackers to exploit the vulnerability to disclose sensitive information from affected systems.
Is authentication required to exploit CVE-2024-23937?
No, authentication is not required to exploit CVE-2024-23937, making it easier for attackers to exploit this vulnerability.