CVE-2024-23973

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jan 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-239746.7Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of p CVE-2024-239758.8SQL injection vulnerability exists in GetDIAE_slogListParameters.CVE-2024-239766.0When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions CVE-2024-239789.8Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be exe CVE-2024-239797.5When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual CVE-2024-23988.6When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximu CVE-2024-239807.5Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privilege CVE-2024-239818.8Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an a CVE-2024-239827.5When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microk CVE-2024-239835.8Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.CVE-2024-239845.3Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosu CVE-2024-239857.5EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.