« Volver al listado

CVE-2023-45318

Estado: ModificadaCrítica (9.8)—

A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Silabs — Gecko Software Development KITWeston-embedded — Uc-http

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45318",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45318",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-20T16:31:01.592003Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "Silicon Labs",
          "product": "Gecko Platform",
          "versions": [
            {
              "status": "affected",
              "version": "Silicon Labs Gecko Platform 4.3.2.0"
            }
          ]
        },
        {
          "vendor": "Weston Embedded",
          "product": "uC-HTTP",
          "versions": [
            {
              "status": "affected",
              "version": "git commit 80d4004"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:silabs:gecko_platform:*:*:*:*:*:*:*:*"
          ],
          "vendor": "silabs",
          "product": "gecko_platform",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.2.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:weston-embedded:uc-http:*:*:*:*:*:*:*:*"
          ],
          "vendor": "weston-embedded",
          "product": "uc-http",
          "versions": [
            {
              "status": "affected",
              "version": "git commit 80d4004"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-02-20T15:15:08.727",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1843",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1843",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1843",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de desbordamiento de búfer de almacenamiento dinámico en la funcionalidad del servidor HTTP de Weston Embedded uC-HTTP git commit 80d4004. Un paquete de red especialmente manipulado puede provocar la ejecución de código arbitrario. Un atacante puede enviar un paquete malicioso para desencadenar esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T06:28:37.220",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silabs:gecko_software_development_kit:4.3.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "630B4655-F4AA-4DAA-8127-BBC89EE6046C"
            },
            {
              "criteria": "cpe:2.3:a:weston-embedded:uc-http:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE7CD12C-6F8F-4347-B9BD-51C46EF0F84E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}