Strix
26.1K

CVE-2023-23299

HIGHCVSS 7.5/10EPSS 0.80%

Last modified

CVE-2023-23299 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.. EPSS estimates a 0.80% chance of exploitation in the next 30 days.

Description

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.80%

52.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GarminConnect-Iq>= 1.0.0, <= 4.1.7

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-23299?
The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.
How severe is CVE-2023-23299?
CVE-2023-23299 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.80% probability of exploitation in the next 30 days.
How do I fix CVE-2023-23299?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-23299?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST