Back
CVE-2023-4041
Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability
Critical9.8EPSS 0.40%
- Published
- Updated
- Reserved
- Assigned by
- Silabs
Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| SilabsCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.40% · top 66% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs
- CWE-787 Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs
- CWE-913 Improper Control of Dynamically-Managed Code Resources (opens in a new tab)All about CWE-913 and its CVEs
- CWE-494 (opens in a new tab)All about CWE-494 and its CVEs
Affected products
Silicon Labs · Gecko Bootloader
- affected < 4.3.1
- affected < 4.2.4
- unaffected 4.3.2
- unaffected 4.2.4
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-4041)Record last updated .