CVE-2023-23306
📋 TL;DR
This vulnerability allows a malicious Connect IQ application to exploit type confusion in the Toybox.Ant.BurstPayload.add API method, leading to out-of-bounds memory writes. Attackers could hijack firmware execution on Garmin devices running vulnerable CIQ API versions. All Garmin smartwatches and fitness devices using affected Connect IQ API versions are impacted.
💻 Affected Systems
- Garmin smartwatches
- Garmin fitness devices
- Garmin wearables with Connect IQ support
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing firmware-level persistence, data theft, and potential bricking of the device.
Likely Case
Malicious apps gaining elevated privileges to access sensitive data, modify device behavior, or disrupt functionality.
If Mitigated
Limited impact through app store review processes and user permission restrictions, though exploitation remains possible.
🎯 Exploit Status
Exploitation requires user to install a malicious Connect IQ app. Technical details and proof-of-concept are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CIQ API version 4.1.8 and later
Vendor Advisory: https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function
Restart Required: Yes
Instructions:
1. Update Garmin device firmware through Garmin Express or Garmin Connect mobile app. 2. Ensure CIQ API version is 4.1.8 or higher. 3. Restart device after update completes.
🔧 Temporary Workarounds
Disable third-party app installation
allPrevent installation of new Connect IQ apps to block potential malicious payloads.
Settings > Apps > Connect IQ Store > Disable app installation
Remove suspicious apps
allUninstall any Connect IQ apps from unknown or untrusted developers.
Settings > Apps > Manage Apps > Select app > Uninstall
🧯 If You Can't Patch
- Restrict device to only essential, verified Connect IQ apps from trusted developers.
- Disable Bluetooth/ANT+ connections when not in use to reduce attack surface.
🔍 How to Verify
Check if Vulnerable:
Check CIQ API version in device settings: Settings > System > About > CIQ API Version. If version is between 2.2.0 and 4.1.7 inclusive, device is vulnerable.Check Version:
Not applicable - check through device settings menuVerify Fix Applied:
Confirm CIQ API version is 4.1.8 or higher after applying firmware update.📡 Detection & Monitoring
Log Indicators:
- Unusual memory access patterns in device logs
- Multiple failed ANT/BurstPayload API calls from single app
Network Indicators:
- Suspicious ANT+ traffic patterns
- Unexpected Bluetooth Low Energy connections
SIEM Query:
Not applicable for typical enterprise SIEM - device-specific logging required🔗 References
- https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function
- https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md
- https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function
- https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md
