« Volver al listado

CVE-2023-28391

Estado: ModificadaCrítica (9.8)—

A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Silabs — Gecko Software Development KITWeston-embedded — Cesium NETWeston-embedded — Uc-http

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28391",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28391",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T14:13:43.865936Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "Silicon Labs",
          "product": "Gecko Platform",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.1.0"
            }
          ]
        },
        {
          "vendor": "Weston Embedded",
          "product": "Cesium NET",
          "versions": [
            {
              "status": "affected",
              "version": "3.07.01"
            }
          ]
        },
        {
          "vendor": "Weston Embedded",
          "product": "uC-HTTP",
          "versions": [
            {
              "status": "affected",
              "version": "v3.01.01"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:silabs:gecko_platform:*:*:*:*:*:*:*:*"
          ],
          "vendor": "silabs",
          "product": "gecko_platform",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.1.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:weston-embedded:cesium_net:3.07.01:*:*:*:*:*:*:*"
          ],
          "vendor": "weston-embedded",
          "product": "cesium_net",
          "versions": [
            {
              "status": "affected",
              "version": "3.07.01"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:weston-embedded:uc-http:3.01.01:*:*:*:*:*:*:*"
          ],
          "vendor": "weston-embedded",
          "product": "uc-http",
          "versions": [
            {
              "status": "affected",
              "version": "3.01.01"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-11-14T10:15:27.937",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1732",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1732",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de corrupción de memoria en la funcionalidad de análisis de encabezados de HTTP Server de Weston Embedded uC-HTTP v3.01.01. Los paquetes de red especialmente manipulados pueden conducir a la ejecución de código. Un atacante puede enviar un paquete malicioso para desencadenar esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T05:47:36.993",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silabs:gecko_software_development_kit:4.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90DDAC84-E71F-44E3-A5A8-D949DC1943D4"
            },
            {
              "criteria": "cpe:2.3:a:weston-embedded:cesium_net:3.07.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44A78DFC-FD24-43A2-A4F4-76A77F46E9A5"
            },
            {
              "criteria": "cpe:2.3:a:weston-embedded:uc-http:3.01.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6939279F-5819-4661-9050-3947010C9B71"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}