Security readout for executives and security teams
Plain-English summary
This CVE affects embedded networking stacks and can let a remote unauthenticated attacker crash or disrupt affected devices by triggering an out-of-bounds read during ICMP/ICMPv6 parsing. The main business risk is device availability, not data theft or integrity loss.
Executive priority
Treat as a moderate availability risk. Prioritize remediation where affected embedded devices support business-critical, remote, or safety-relevant operations, especially if they are reachable from less trusted networks.
Technical view
CVE-2023-39541 is a CWE-126 out-of-bounds read in ICMP and ICMPv6 parsing in Weston Embedded uC-TCP-IP v3.06.01, also listed against Silicon Labs Gecko Platform 4.3.1.0. CVSS 3.1 is 5.9: network reachable, high complexity, no privileges or user interaction, availability impact only.
Likely exposure
Exposure is most likely in embedded or IoT products built on Weston Embedded uC-TCP-IP v3.06.01 or Silicon Labs Gecko Platform 4.3.1.0. Internet or broadly routed network access to affected device network stacks increases operational risk.
Exploitation context
The source bundle describes a malicious network packet causing denial of service, but CISA KEV status is false and no cited source states active exploitation. Attack complexity is rated high, which lowers likelihood but does not remove risk for exposed embedded systems.
Researcher notes
Evidence supports denial of service through an out-of-bounds read in ICMP/ICMPv6 parsing. The bundle does not provide a named fixed version, exploit maturity, or field exploitation evidence, so remediation should be anchored to current vendor advisories.
Mitigation direction
- Identify products or firmware using the affected networking stack versions.
- Check Silicon Labs and Weston Embedded guidance for fixed releases or mitigations.
- Prioritize updates for exposed or safety-sensitive embedded devices.
- Limit untrusted network reachability to affected devices where operationally acceptable.
- Monitor affected devices for unexpected resets, hangs, or network-stack failures.
Validation and detection
- Review SBOMs, build manifests, and vendor advisories for affected stack versions.
- Confirm whether deployed firmware includes uC-TCP-IP v3.06.01 or Gecko Platform 4.3.1.0.
- Map which affected devices receive ICMP or ICMPv6 from untrusted networks.
- Verify remediation by confirming upgraded or vendor-cleared firmware versions.
- Correlate device availability incidents with network traffic and firmware exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-126: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-39541 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Over-read
Buffer Over-read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.