CVE-2023-4257

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120 CWE-131

Affected software

Vendor	Product	Versions
zephyrproject-rtos	Zephyr	<= 3.4

References

http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Nov/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/11/07/1Mailing List
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-853q-q69w-gf5jExploit, Vendor Advisory
http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.htmlExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Nov/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/11/07/1Mailing List
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-853q-q69w-gf5jExploit, Vendor Advisory

Timeline

Published: Oct 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425703.3Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN.CVE-2023-425716.8Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the S CVE-2023-425725.5Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information.CVE-2023-425735.5PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data.CVE-2023-425747.8Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHo CVE-2023-425756.8Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i CVE-2023-425766.8Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i CVE-2023-425772.4Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows CVE-2023-425787.5Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote atta CVE-2023-425795.3Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49,CVE-2023-42586.5In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be a CVE-2023-425809.8Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to inst