title: Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
description: Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.
problem types: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
affected:
{
defaultStatus: unaffected
product: Gecko Bootloader
vendor: silabs.com
versions:
lessThanOrEqual: 4.0.1, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL