CVE-2024-23973 HIGH

CVE-2024-23973: Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow

Vendor Silicon Labs
Product Gecko OS
Weakness CWE-120
Published January 30, 2025
Last update August 26, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.  The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Key dates

02Disclosure timeline

January 30, 2025 CVE published
August 26, 2025 Record updated