CVE-2024-23937CWE-200

Silicon Labs Gecko OS Debug Interface Format String

Medium · published January 31, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-01-31T00:07Z
EPSS history
Timeline
  • 31 JAN 00:07Z
    Silicon Labs Gecko OS Debug Interface Format String
    cvelistv5