High severity · published Nov 21, 2023
CVE-2023-4424
bt: hci: DoS and possible RCE
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zephyr · zephyrproject-rtos
before 3.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4424
Third Party Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j4qm-xgpf-qjw3
More from Zephyr
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser
9.8
CVE-2023-6881
fs: fuse: buffer overflow vulnerability in the Zephyr FS
9.8
CVE-2023-5779
can: out of bounds in remove_rx_filter function
9.8
CVE-2023-6249
ipm: signed to unsigned conversion problem in esp32_ipm_send