What is the severity of CVE-2024-23937?

CVE-2024-23937 has been rated as a high-severity vulnerability due to its potential to disclose sensitive information without requiring authentication.

How do I fix CVE-2024-23937?

To mitigate CVE-2024-23937, it is recommended to update to the latest patched version of Silicon Labs Gecko OS as soon as it becomes available.

Who is affected by CVE-2024-23937?

CVE-2024-23937 affects installations of Silicon Labs Gecko OS that use the debug interface.

What type of attack is possible with CVE-2024-23937?

CVE-2024-23937 allows network-adjacent attackers to exploit the vulnerability to disclose sensitive information from affected systems.

Is authentication required to exploit CVE-2024-23937?

No, authentication is not required to exploit CVE-2024-23937, making it easier for attackers to exploit this vulnerability.

Vulnerability/
CVE-2024-23937

medium

4.3

CWE

863

31/1/2025

12/2/2025

18/2/2025

CVE-2024-23937: (Pwn2Own) Silicon Labs Gecko OS Debug Interface Format String Information Disclosure Vulnerability

First published: Fri Jan 31 2025(Updated: )

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.

Credit: ics-cert@hq.dhs.gov

Affected Software	Affected Version	How to fix
SiLabs Gecko SDK

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-23937?
CVE-2024-23937 has been rated as a high-severity vulnerability due to its potential to disclose sensitive information without requiring authentication.
How do I fix CVE-2024-23937?
To mitigate CVE-2024-23937, it is recommended to update to the latest patched version of Silicon Labs Gecko OS as soon as it becomes available.
Who is affected by CVE-2024-23937?
CVE-2024-23937 affects installations of Silicon Labs Gecko OS that use the debug interface.
What type of attack is possible with CVE-2024-23937?
CVE-2024-23937 allows network-adjacent attackers to exploit the vulnerability to disclose sensitive information from affected systems.
Is authentication required to exploit CVE-2024-23937?
No, authentication is not required to exploit CVE-2024-23937, making it easier for attackers to exploit this vulnerability.

collector/nvd-api
source/NVD
agent/type
agent/first-publish-date
agent/description
agent/title
agent/severity
agent/last-modified-date
agent/references
agent/author
agent/source
agent/weakness
agent/softwarecombine
agent/tags
agent/event
collector/zdi-advisory
source/ZDI
alias/ZDI-24-869
alias/ZDI-CAN-23189
alias/CVE-2024-23937
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/silicon labs
canonical/silabs gecko sdk

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.