{"id":"CVE-2023-0970","aliases":["EUVD-2023-12955","GHSA-8c88-9jmc-phqr"],"status":"published","title":"Serial API Buffer Overflow in Z/IP Gateway","description":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00271,"percentile":0.19474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-120","CWE-125","CWE-787"],"published":"2023-06-21T19:41:46Z","modified":"2026-06-17T05:26:46Z","products":[{"vendor":"silabs","product":"z\\/ip_gateway_sdk"},{"vendor":"silicon labs","product":"z/ip gateway"}],"references":[{"url":"https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0970"},{"url":"https://github.com/advisories/GHSA-8c88-9jmc-phqr"}],"sources":{"cve":[{"id":"CVE-2023-0970","title":"Serial API Buffer Overflow in Z/IP Gateway","description":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.","status":"published","published":"2023-06-21T19:41:46.419Z","modified":"2024-12-06T18:27:49.739Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787","CWE-125"],"updated_at":"2026-11-02T14:35:35.580545Z"}],"euvd":[{"id":"EUVD-2023-12955","description":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.","status":"published","published":"2023-06-21T19:41:46Z","modified":"2024-12-06T18:27:49Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-8c88-9jmc-phqr","title":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier...","description":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.","status":"published","published":"2023-06-21T21:30:24Z","modified":"2024-09-25T18:32:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-120","CWE-125"],"updated_at":"2026-11-02T14:58:20.799511Z"}],"nvd":[{"id":"CVE-2023-0970","description":"Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave controller device to overwrite global memory and potentially execute arbitrary code.","status":"published","published":"2023-06-21T20:15:09.843Z","modified":"2026-06-17T05:26:46.107Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-787","CWE-120"],"updated_at":"2026-11-02T14:08:12.414559Z"}]}}