==========================
== Gharib Personal Blog ==
==========================
A Techi Personal Blog

CVE-2024-23963 - Alpine Halo9 Bluetooth PBAP Code Execution Vulnerability

cve cybersecurity security

CVE ID : CVE-2024-23963
Published : Jan. 31, 2025, 12:15 a.m. | 1 day, 3 hours ago
Description : This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the PBAP_DecodeVCARD function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Go to Source