silabs gecko bootloader vulnerabilities

Latest silabs gecko bootloader CVEs

Newest publication first

1. CVE-2023-3487 Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access

   Published 2023-10-20

   High·CVSS 7.8 EPSS 0.25%

   An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.

2. CVE-2023-4041 Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

   Published 2023-08-23

   Critical·CVSS 9.8 EPSS 0.40%

   Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issu...

3. CVE-2022-24936 Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices

   Published 2022-11-02

   Critical·CVSS 9.1 EPSS 0.93%

   Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.