« Volver al listado

CVE-2023-4041

Estado: ModificadaCrítica (9.8)—

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Silabs — Gecko Bootloader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-4041",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4041",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-03T13:51:29.426747Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@silabs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@silabs.com",
      "affectedData": [
        {
          "repo": "https://github.com/SiliconLabs/gecko_sdk/releases",
          "vendor": "Silicon Labs",
          "modules": [
            "Firmware Update File Parser"
          ],
          "product": "Gecko Bootloader",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.1",
              "versionType": "4.3.1"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.2.4",
              "versionType": "4.2.4"
            },
            {
              "status": "unaffected",
              "version": "4.3.2"
            },
            {
              "status": "unaffected",
              "version": "4.2.4"
            }
          ],
          "platforms": [
            "ARM"
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:*:*"
          ],
          "vendor": "silabs",
          "product": "gecko_bootloader",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.2",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.3.2"
            },
            {
              "status": "unaffected",
              "version": "4.2.4"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-23T05:15:47.990",
  "references": [
    {
      "url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1",
      "tags": [
        "Permissions Required"
      ],
      "source": "product-security@silabs.com"
    },
    {
      "url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000XT8GsQAL?operationContext=S1",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@silabs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        },
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        },
        {
          "lang": "en",
          "value": "CWE-494"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects \"Standalone\" and \"Application\" versions of Gecko Bootloader."
    }
  ],
  "lastModified": "2026-06-17T06:36:58.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:*",
              "vulnerable": true,
              "matchCriteriaId": "A5C31F19-9E70-40C4-946F-AA72D4B12A13",
              "versionEndExcluding": "4.2.4"
            },
            {
              "criteria": "cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:*",
              "vulnerable": true,
              "matchCriteriaId": "D1FC9AD9-3879-4C5F-8441-F9C85A4E08FD",
              "versionEndExcluding": "4.3.2",
              "versionStartIncluding": "4.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@silabs.com"
}