CVE-2023-38562

HIGH

Weston Embedded uC-TCP-IP <3.06.01 - Memory Corruption

Title source: llm

Description

A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted set of network packets can lead to memory corruption, potentially resulting in code execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.

References (2)

[Exploit, Third Party Advisory] https://talosintelligence.com/vulnerability_reports/TALOS-2023-1829

[Third Party Advisory] https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1829

Scores

CVSS v3 8.7

EPSS 0.0027

EPSS Percentile 50.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Classification

CWE

CWE-415

Status published

Affected Products (1)

weston-embedded/uc-tcp-ip

Timeline

Published Feb 20, 2024

Tracked Since Feb 18, 2026