Silicon Labs Gecko OS Stack-Based Buffer Overflow Vulnerability in http_download Command Allowing Remote Code Execution

A stack-based buffer overflow vulnerability has been identified in Silicon Labs Gecko OS, specifically within the http_download command. This issue allows network-adjacent attackers to execute arbitrary code on the affected device. The vulnerability arises from inadequate validation of user-supplied data length before it is copied to a stack-based buffer, creating an opportunity for code execution in the context of the device. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.

Remediation

Silicon Labs has released an update to address this vulnerability. For more details, please refer to the Silicon Labs Community.