Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23929 State: PUBLISHED Published: 2025-01-31T00:13:03.982Z Last Updated: 2025-07-01T13:37:17.684Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Pioneer Products: DMH-WT7600NEX Problem Types: CWE-863 Description: This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the telematics functionality. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations.
lity. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1044/ - https://jpn.pioneer/ja/car/dl/dmh-sz700_sf700/
CVE ID: CVE-2024-23930 State: PUBLISHED Published: 2025-01-31T00:01:54.514Z Last Updated: 2025-08-26T20:58:21.278Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Pioneer Products: DMH-WT7600NEX Problem Types: CWE-404 Description: This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Media service, which listens on TCP port 42000 by default. The issue results from improper handling of error conditions. An attacker can leverage this vulnerability to create a denial-
ssue results from improper handling of error conditions. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1043/ - https://jpn.pioneer/ja/car/dl/dmh-sz700_sf700/
CVE ID: CVE-2024-23933 State: PUBLISHED Published: 2024-09-23T14:12:38.125Z Last Updated: 2025-08-26T20:58:21.507Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sony Products: XAV-AX5500 Problem Types: CWE-121 Description: Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of
the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23238 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-877/ - https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156
CVE ID: CVE-2024-23934 State: PUBLISHED Published: 2024-09-23T14:16:02.143Z Last Updated: 2025-08-26T21:01:17.344Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sony Products: XAV-AX5500 Problem Types: CWE-121 Description: Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMV/ASF files. A crafted Extended Content De
ge or open a malicious file. The specific flaw exists within the parsing of WMV/ASF files. A crafted Extended Content Description Object in a WMV media file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. . Was ZDI-CAN-22994. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-875/ - https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156
CVE ID: CVE-2024-23935 State: PUBLISHED Published: 2024-09-28T06:13:30.882Z Last Updated: 2024-10-03T14:17:20.805Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: Halo9 Problem Types: CWE-121 Description: Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the DecodeUTF7 function. The issue results from the lac
r to exploit this vulnerability. The specific flaw exists within the DecodeUTF7 function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23249 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-848/
CVE ID: CVE-2024-23937 State: PUBLISHED Published: 2025-01-31T00:07:40.930Z Last Updated: 2025-07-01T13:40:42.425Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-200 Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnera
r-supplied string before using it as a format specifier. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-869/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2024-23938 State: PUBLISHED Published: 2024-09-28T06:06:43.976Z Last Updated: 2024-10-03T14:12:41.628Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-121 Description: Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The issue results from the lack of proper validation of the length of user-supplied data
sts within the debug interface. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23184 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-868/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2024-23940 State: PUBLISHED Published: 2024-01-29T18:22:34.819Z Last Updated: 2025-05-29T15:08:39.946Z Vendors: Trend Micro, Inc. Products: Trend Micro Security (Consumer) uiAirSupport Description: Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/proxying vulnerability, which if exploited could allow an attacker to impersonate and modify a library to execute code on the system and ultimately escalate privileges on an affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-12134 - https://helpcenter.trendmicro.com/ja-jp/article/tmka-12132 - https://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1
CVE ID: CVE-2024-23941 State: PUBLISHED Published: 2024-02-01T03:56:12.231Z Last Updated: 2025-06-04T15:25:00.832Z Vendors: Intermesh BV Products: Group Office Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Intermesh/groupoffice/ - https://www.group-office.com/ - https://jvn.jp/en/jp/JVN63567545/
CVE ID: CVE-2024-23942 State: PUBLISHED Published: 2025-03-18T11:03:35.116Z Last Updated: 2025-08-20T06:11:05.971Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: MB connect line Products: mbCONNECT24, mbNET, mbNET.rokey, mymbCONNECT24 Problem Types: CWE-312 Description: A local user may find a configuration file on the client workstation with unencrypted sensitive data. This allows an attacker to impersonate the device or prevent the device from accessing the cloud portal which leads to a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-010
CVE ID: CVE-2024-23943 State: PUBLISHED Published: 2025-03-18T11:03:49.466Z Last Updated: 2025-03-18T13:13:28.924Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: MB connect line Products: mbCONNECT24, mbNET, mbNET.rokey, mymbCONNECT24 Problem Types: CWE-306 Description: An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-010
CVE ID: CVE-2024-23944 State: PUBLISHED Published: 2024-03-15T10:26:12.848Z Last Updated: 2025-07-03T14:52:57.231Z Vendors: Apache Software Foundation Products: Apache ZooKeeper Problem Types: CWE-862 Description: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that
th of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k
CVE ID: CVE-2024-23945 State: PUBLISHED Published: 2024-12-23T15:26:54.477Z Last Updated: 2025-03-19T13:34:26.019Z Vendors: Apache Software Foundation Products: Apache Hive, Apache Spark Problem Types: CWE-209 Description: Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signat
d user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/hive - https://github.com/apache/spark - https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19 - http
https://github.com/apache/spark - https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19 - https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4 - https://issues.apache.org/jira/browse/HIVE-9710 - https://issues.apache.org/jira/browse/SPARK-14987 - https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc - https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc
CVE ID: CVE-2024-23946 State: PUBLISHED Published: 2024-02-28T15:44:41.714Z Last Updated: 2025-02-13T17:40:01.762Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-22, CWE-434 Description: Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://ofbiz.apache.org/release-notes-18.12.12.html - https://issues.apache.org/jira/browse/OFBIZ-12884 - https://lists.apache.org/thread/w4lp5ncpzttf41hn5bsc04mzq4o6lw
tml - https://issues.apache.org/jira/browse/OFBIZ-12884 - https://lists.apache.org/thread/w4lp5ncpzttf41hn5bsc04mzq4o6lw3g - http://www.openwall.com/lists/oss-security/2024/02/28/9
CVE ID: CVE-2024-23947 State: PUBLISHED Published: 2024-05-28T14:02:41.624Z Last Updated: 2025-02-13T17:40:02.487Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-787 Description: Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling a `binary` `.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
andling a `binary` `.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926
CVE ID: CVE-2024-23948 State: PUBLISHED Published: 2024-05-28T14:02:41.707Z Last Updated: 2025-02-13T17:40:03.609Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-787 Description: Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_nodes` function while handling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
andling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926
CVE ID: CVE-2024-23949 State: PUBLISHED Published: 2024-05-28T14:02:41.793Z Last Updated: 2025-02-13T17:40:04.202Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-787 Description: Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_node_field` function while handling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
ile handling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926
CVE ID: CVE-2024-23950 State: PUBLISHED Published: 2024-05-28T14:02:41.890Z Last Updated: 2025-02-13T17:40:04.868Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-787 Description: Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_element_field` function while handling an `binary`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
while handling an `binary`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926
CVE ID: CVE-2024-23951 State: PUBLISHED Published: 2024-05-28T14:02:41.985Z Last Updated: 2025-02-13T17:40:05.946Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libigl Products: libigl Problem Types: CWE-787 Description: Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the `igl::MshLoader::parse_element_field` function while handling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
while handling an `ascii`.msh` file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1926 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1926
CVE ID: CVE-2024-23952 State: PUBLISHED Published: 2024-02-14T11:09:47.113Z Last Updated: 2025-02-13T17:40:06.510Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-400 Description: This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Additional Analyst Notes: - CVE Program Container: - CI
et versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx - http://www.openwall.com/lists/oss-security/2024/02/14/2 - http://www.openwall.com/lists/oss-security/2024/02/14/3
CVE ID: CVE-2024-23953 State: PUBLISHED Published: 2025-01-28T09:07:22.333Z Last Updated: 2025-03-14T15:44:14.787Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: CWE-208 Description: Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0, which fixes this issue. The problem occurs when an application doesn’t use a constant-time algorithm for validating a signature. The method Arrays.equals() returns false right away when it se
use a constant-time algorithm for validating a signature. The method Arrays.equals() returns false right away when it sees that one of the input’s bytes are different. It means that the comparison time depends on the contents of the arrays. This little thing may allow an attacker to forge a valid signature for an arbitrary message byte by byte. So it might allow malicious users to submit splits/work with selected signatures to LLAP without running as a privileged user, potentially leading to DDoS attack. More details in the reference section. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/hive - https://github.com/apache/hi
A ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/hive - https://github.com/apache/hive/commit/b418e3c9f479ba8e7d31e6470306111002ffa809 - https://issues.apache.org/jira/browse/HIVE-28030 - https://blog.gypsyengineer.com/en/security/preventing-timing-attacks-with-codeql.html - https://cqr.company/web-vulnerabilities/timing-attacks/ - https://lists.apache.org/thread/0nloywj49nbtlc6l3c6363qvq7o1ztb7
CVE ID: CVE-2024-23957 State: PUBLISHED Published: 2024-09-28T06:08:24.755Z Last Updated: 2024-10-03T13:49:12.857Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Autel Products: MaxiCharger AC Elite Business C50 Problem Types: CWE-121 Description: Autel MaxiCharger AC Elite Business C50 DLB_HostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLB_HostHeartBeat handler of th
ation is not required to exploit this vulnerability. The specific flaw exists within the DLB_HostHeartBeat handler of the DLB protocol implementation. When parsing an AES key, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23241 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-854/