Unrated severityNVD Advisory· Published May 23, 2023· Updated Jan 21, 2025

CVE-2023-23299

Description

The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely. A malicious application with specially crafted code and data sections could access restricted CIQ modules, call their functions and disclose sensitive data such as user profile information and GPS coordinates, among others.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GarminOS/CIQ APIdescription
Garmin/CIQ APIllm-fuzzy
Range: >=1.0.0, <=4.1.7

Patches

Vulnerability mechanics

References

developer.garmin.com/connect-iq/core-topics/manifest-and-permissions/mitre
github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23299.mdmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000