CVE-2023-6249
Zephyrproject Zephyr ≤ 3.5.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-6249 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Zephyrproject Zephyr. Its CVSS base score is 8.0 (High).
Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58494
Vulnerability Data
Signed to unsigned conversion esp32_ipm_send
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds incorrect type conversions or casts.
Requiring documented development standards and tools can mandate safe typing, casting rules, and compiler checks that stop the weakness from being introduced.
Security engineering principles can require type-safe design and casting practices that structurally avoid incorrect conversions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes type-safety reviews that reduce incorrect casts.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent any type-conversion defects from arising or being exploitable.
Secure architecture principles discourage unsafe type conversions in design.
Secure coding standards directly forbid or detect incorrect type casts.
Security testing can uncover type-conversion defects before release.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-704, a class-level weakness, and none of its children carries one either.