CVE-2023-45318 is a critical heap based buffer overflow in the HTTP server of Weston Embedded uC-HTTP, scored 10.0. A crafted network packet can lead to code execution. Cisco Talos reports a vendor patch from February 2024, so rebuild embedded firmware with the fixed code.
What's affected
The NVD record names Weston Embedded uC-HTTP at git commit 80d4004 and Silicon Labs Gecko SDK 4.3.2.0. The Cisco Talos report, TALOS-2023-1843, lists the same two: uC-HTTP at that commit, and the Silicon Labs Gecko Platform 4.3.2.0, which Talos says the vendor confirmed.
Talos gives the timeline: vendor disclosure on 2023-10-26, a vendor patch on 2024-02-14, and public release on 2024-02-20. The report does not name a patched version number. Check the uC-HTTP repository and Silicon Labs release notes for the exact fixed build before you plan the rebuild.
The score is the maximum, 10.0, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. It is reachable over the network without privileges or user interaction. The record and Talos agree on the score.
How to check if you're exposed
uC-HTTP is a library compiled into embedded products, so the exposure is rarely visible as an installed package. Work from source and from your bills of materials.
If you build firmware that uses Silicon Labs Gecko SDK or uC-HTTP, search your source tree and vendored code:
grep -ril "uc-http\|HTTPsReq_ProtocolVerParse" .
git log --oneline -1 -- path/to/uc-http
Compare the commit or SDK version against the vendor release that contains the February 2024 fix. For devices from third parties, ask the manufacturer whether their firmware uses this HTTP server and which build is patched.
What to do now
- Find every product you build or buy that embeds uC-HTTP or the Gecko SDK 4.3.2.0.
- Move to the vendor's patched code from February 2024, confirming the exact version in Silicon Labs and Weston Embedded notes.
- Rebuild and redeploy firmware, and keep the build record with the commit hash.
- Until devices are updated, keep their HTTP management interface off untrusted networks.
- Ask suppliers of embedded devices for a software bill of materials that names the HTTP server component.
Why it matters
The weakness is a heap based buffer overflow, CWE-122, which is a specific case of an out of bounds write, CWE-787. The Talos report points to the code that parses the protocol version of an HTTP request, where the remaining receive buffer length is reduced by the wrong amount. A packet that exploits the miscount can write outside the buffer.
Embedded HTTP servers are attractive to attackers because the devices rarely get updated, run without memory protections, and sit on networks nobody monitors. Talos states that the only mitigation is to change the code in uC-HTTP itself, so patching depends on every vendor that embedded it.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the sources I read do not report exploitation. The size of the score is about reach and impact, not observed attacks.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I fix this with a configuration change?
Talos says the only mitigation is a change to the uC-HTTP code. Network restrictions reduce exposure but do not remove the flaw.
Which version is fixed?
The Talos report gives the patch date, 2024-02-14, but not a version number. Check the vendor's release notes.
Sources
Last reviewed: 19 October 2026.
