CVE-2022-24936

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-249379.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.CVE-2022-249387.5A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the e CVE-2022-249396.5A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which l CVE-2022-24945.4Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-249429.8Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request.CVE-2022-249467.5Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Ele CVE-2022-249478.8Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade CVE-2022-249486.1A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences sc CVE-2022-249497.5A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer CVE-2022-24954.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-249507.5A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authoriz CVE-2022-249517.0A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, en