CVE-2023-23306

CVSS V2 None CVSS V3 None
Description
The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.
Overview
  • CVE ID
  • CVE-2023-23306
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Awaiting Analysis
  • Published Version
  • 2023-05-23T20:15:09
  • Last Modified Date
  • 2023-05-23T20:48:24
History
Created Old Value New Value Data Type Notes
2023-05-23 21:01:07 Added to TrackCVE