« Volver al listado

CVE-2023-31247

Estado: ModificadaCrítica (9.8)—

A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Silabs — Gecko Software Development KITWeston-embedded — Cesium NETWeston-embedded — Uc-http

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-31247",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-31247",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T14:25:54.364796Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "Silicon Labs",
          "product": "Gecko Platform",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.1.0"
            }
          ]
        },
        {
          "vendor": "Weston Embedded",
          "product": "Cesium NET",
          "versions": [
            {
              "status": "affected",
              "version": "3.07.01"
            }
          ]
        },
        {
          "vendor": "Weston Embedded",
          "product": "uC-HTTP",
          "versions": [
            {
              "status": "affected",
              "version": "v3.01.01"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-11-14T10:15:28.393",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1746",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1746",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1746",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de corrupción de memoria en la funcionalidad de análisis de encabezados de HTTP Server Host de Weston Embedded uC-HTTP v3.01.01. Un paquete de red especialmente manipulado puede provocar la ejecución de código. Un atacante puede enviar un paquete malicioso para desencadenar esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T05:56:40.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silabs:gecko_software_development_kit:4.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90DDAC84-E71F-44E3-A5A8-D949DC1943D4"
            },
            {
              "criteria": "cpe:2.3:a:weston-embedded:cesium_net:3.07.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44A78DFC-FD24-43A2-A4F4-76A77F46E9A5"
            },
            {
              "criteria": "cpe:2.3:a:weston-embedded:uc-http:3.01.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6939279F-5819-4661-9050-3947010C9B71"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}