The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information.
References
Configurations
History
21 Nov 2024, 07:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html - Product | |
| References | () https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md - Exploit |
30 May 2023, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Garmin connect-iq
Garmin |
|
| CPE | cpe:2.3:a:garmin:connect-iq:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| References | (MISC) https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html - Product | |
| References | (MISC) https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md - Exploit | |
| CWE | NVD-CWE-noinfo |
Information
Published : 2023-05-23 20:15
Updated : 2024-11-21 07:45
NVD link : CVE-2023-23304
Mitre link : CVE-2023-23304
CVE.ORG link : CVE-2023-23304
JSON object : View
Products Affected
garmin
- connect-iq
CWE