CVE-2023-23304

2023-05-2300:00:00

mitre

www.cve.org

cve-2023-23304

garminos

tvm

ciq api

sensorhistory

permission bypass

sensitive information disclosure

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

49.0%

JSON

The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the Toybox.SensorHistory module without permission. A malicious application could call any functions from the Toybox.SensorHistory module without the user’s consent and disclose potentially private or sensitive information.