CVE-2023-38562
Assigner: talos
Published: 2024-02-20T14:45:02.733Z
State: PUBLISHED
affected: vendor: Weston Embedded
product: uC-TCP-IP
versions: version: v3.06.01
status: affected
descriptions: value: A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
problemTypes: descriptions: description: CWE-415: Double Free
type: CWE
cweId: CWE-415
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
credits: value: Discovered by Kelly Patterson of Cisco Talos.