PT-2024-15189 · Zephyr Os · Zephyr Os

Bronallo-Bd · Published 2024-03-15 · Updated 2025-02-03 · CVE-2023-7060

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Zephyr OS (affected versions not specified)

Description The issue concerns the handling of IP packets in Zephyr OS. Specifically, it does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.0.1 or the destination address. This could potentially lead to security issues, although specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-7060

GHSA-FJC8-223C-QGQR

Affected Products

Zephyr Os

References · 11

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fjc8-223c-qgqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7060 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7060 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1768735928825131359 · Twitter Post
• https://twitter.com/fletch_ai/status/1771025771127013611 · Twitter Post
• https://twitter.com/cipherstorm/status/1770755529461080516 · Twitter Post
• https://twitter.com/IoTInformer/status/1770888109980565741 · Twitter Post
• https://twitter.com/opsmatters_uk/status/1771002322425901401 · Twitter Post
• https://twitter.com/CVEnew/status/1768708102369562803 · Twitter Post
• https://twitter.com/opsmatters_uk/status/1772800234172621180 · Twitter Post
• https://t.me/cvenotify/109722 · Telegram Post