CVE-2022-24936CWE-119

Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices

High · published November 2, 2022

CVSS v3.1
8.3
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2022-11-02T17:25Z
EPSS history
Timeline
  • 02 NOV 17:25Z
    Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
    cvelistv5