GCVE - cpe:2.3:a:garmin:connect-iq:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:garmin:connect-iq:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Garmin (`aff8dba5-0512-5460-8580-b94b53346932`)
Product	Connect Iq (`88e2da23-8853-5513-b2ca-aed1160c86b5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-23306`	vulnerable	2026-06-08 05:54:27.910931	Details available The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware. Published: 2023-05-23T00:00:00.000Z Updated: 2025-01-31T13:48:21.318Z Open on db.gcve.eu Reference links https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23305`	vulnerable	2026-06-08 05:54:27.910625	Details available The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware. Published: 2023-05-23T00:00:00.000Z Updated: 2025-01-31T13:47:22.908Z Open on db.gcve.eu Reference links https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23305.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23304`	vulnerable	2026-06-08 05:54:27.910330	Details available The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information. Published: 2023-05-23T00:00:00.000Z Updated: 2025-01-31T13:46:38.436Z Open on db.gcve.eu Reference links https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23303`	vulnerable	2026-06-08 05:54:27.910021	Details available The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware. Published: 2023-05-23T00:00:00.000Z Updated: 2025-01-21T14:47:35.365Z Open on db.gcve.eu Reference links https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#enableEncryption-instance_function https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23303.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23302`	vulnerable	2026-06-08 05:54:27.909748	Details available The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware. Published: 2023-05-23T00:00:00.000Z Updated: 2025-01-21T14:49:08.831Z Open on db.gcve.eu Reference links https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/GenericChannel.html#setDeviceConfig-instance_function https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23302.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23301`	vulnerable	2026-06-08 05:54:27.909456	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23300`	vulnerable	2026-06-08 05:54:27.909183	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23299`	vulnerable	2026-06-08 05:54:27.908871	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23298`	vulnerable	2026-06-08 05:54:27.908452	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.