High severity · published May 30, 2023
CVE-2023-0779
net: shell: Improper input validation
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
zephyr · zephyrproject-rtos
before v3.3; through v2.7.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0779
Vendor Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9xj8-6989-r549
More from zephyr
10.0
CVE-2023-4260
Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser
9.8
CVE-2023-6881
fs: fuse: buffer overflow vulnerability in the Zephyr FS
9.8
CVE-2023-5779
can: out of bounds in remove_rx_filter function