CVE-2024-23973

High

Published: 31 January 2025

Published

31 January 2025

Modified

30 September 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0016 36.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23973 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Silabs Gecko Os. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2024-23973 is a stack-based buffer overflow vulnerability (CWE-120) in Silicon Labs Gecko OS, stemming from inadequate validation of the length of user-supplied data in HTTP GET request handling before copying it to a stack-based buffer. This flaw affects installations of the Gecko OS, enabling network-adjacent attackers to execute arbitrary code in the context of the device without requiring authentication. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.

Network-adjacent attackers, positioned on the same local network segment as the affected device, can exploit this vulnerability by sending crafted HTTP GET requests. No privileges or user interaction are needed, allowing low-complexity exploitation that grants remote code execution on the device itself.

Silicon Labs and Zero Day Initiative have published advisories detailing the issue, available at https://community.silabs.com/a45Vm0000000Atp and https://www.zerodayinitiative.com/advisories/ZDI-24-873/, respectively, which security practitioners should consult for patch information and mitigation guidance.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-21399

Vulnerability details

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP GET requests. The issue results from…

the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.

CWE(s): CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

Stack-based buffer overflow in unauthenticated HTTP GET handling enables remote code execution by network-adjacent attackers, directly mapping to exploitation of the exposed service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1