CVE-2023-23302

概要

参考情報

• developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html · Product
• anvilsecure/garmin-ciq-app-research · Exploit

connect-iq のその他の脆弱性

• CVE-2023-23306緊急 9.8The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can r…
• CVE-2023-23305緊急 9.8The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A…
• CVE-2023-23304緊急 9.1The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toyb…
• CVE-2023-23303緊急 9.8The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which ca…
• CVE-2023-23301緊急 9.8The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end…