CVE-2022-24942
Published: 15 November 2022
Summary
CVE-2022-24942 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Silabs Micrium Uc-Http. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A heap-based buffer overflow vulnerability, tracked as CVE-2022-24942, exists in the HTTP Server functionality of Micrium uC-HTTP version 3.01.01. The flaw, also referenced under CWEs 122 and 787, permits an out-of-bounds write condition when processing crafted HTTP requests and carries a CVSS 3.1 score of 9.1 reflecting network-accessible attack complexity without authentication requirements.
An unauthenticated remote attacker can send a malicious HTTP request to the affected server component, resulting in remote code execution or, per the CVSS impact metrics, high integrity and availability consequences without confidentiality loss. Exploitation requires only network reachability to the HTTP service and no user interaction.
Public references from Silicon Labs point to updated code in the Gecko SDK, specifically revisions in platform/micrium_os/net/source/http/server/http_server_req.c, indicating that the issue has been addressed in subsequent Micrium OS releases derived from the original uC-HTTP stack.
The associated EPSS score has remained near 0.10 without a pronounced rise from a low baseline, indicating moderate but stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29697
Vulnerability details
Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.