This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://community.silabs.com/a45Vm0000000Atp | Permissions Required |
| https://www.zerodayinitiative.com/advisories/ZDI-24-869/ | Third Party Advisory |
Configurations
History
30 Jun 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 |
18 Jun 2025, 15:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://community.silabs.com/a45Vm0000000Atp - Permissions Required | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-24-869/ - Third Party Advisory | |
| First Time |
Silabs
Silabs gecko Os |
|
| CPE | cpe:2.3:o:silabs:gecko_os:*:*:*:*:*:*:*:* |
31 Jan 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-31 00:15
Updated : 2025-07-01 14:15
NVD link : CVE-2024-23937
Mitre link : CVE-2024-23937
JSON object : View
Products Affected
silabs
- gecko_os
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor