CVE-2023-28379 – This vulnerability allows remote attackers to e... (How to Fix)

📋 TL;DR

This vulnerability allows remote attackers to execute arbitrary code on systems running Weston Embedded uC-HTTP v3.01.01 by sending specially crafted HTTP packets. It affects any device or application using this specific version of the uC-HTTP server library. Successful exploitation could lead to complete system compromise.

💻 Affected Systems

Products:

Weston Embedded uC-HTTP

Versions: v3.01.01

Operating Systems: Any OS running uC-HTTP v3.01.01

Default Config Vulnerable: ⚠️ Yes

Notes: Any device or application using uC-HTTP v3.01.01 HTTP server functionality is vulnerable

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to full system compromise, data theft, and persistent backdoor installation

🟠

Likely Case

Service disruption, denial of service, or limited code execution depending on system privileges

🟢

If Mitigated

Denial of service or service disruption if exploit attempts are blocked

🌐 Internet-Facing: HIGH - Network-accessible HTTP servers are directly vulnerable to remote exploitation

🏢 Internal Only: HIGH - Internal systems using affected software remain vulnerable to network-based attacks

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting specific HTTP packets but no authentication is needed

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: v3.01.02 or later

Vendor Advisory: https://www.weston-embedded.com/security-advisories

Restart Required: Yes

Instructions:

1. Download latest uC-HTTP version from Weston Embedded website
2. Replace vulnerable uC-HTTP library files
3. Recompile applications using the library
4. Restart affected services

🔧 Temporary Workarounds

Network Segmentation

all

Isolate affected systems from untrusted networks

HTTP Request Filtering

linux

Block or filter malformed HTTP requests at network perimeter

iptables -A INPUT -p tcp --dport 80 -m string --string "malformed-boundary" --algo bm -j DROP

🧯 If You Can't Patch

Implement strict network access controls to limit exposure
Deploy intrusion detection systems to monitor for exploit attempts

🔍 How to Verify

Check if Vulnerable:

Check uC-HTTP library version in application binaries or configuration files

Check Version:

strings application_binary | grep -i 'uc-http' || check build configuration files

Verify Fix Applied:

Verify uC-HTTP version is v3.01.02 or later after update

📡 Detection & Monitoring

Log Indicators:

Unusual HTTP request patterns
Server crashes or restarts
Memory allocation errors in logs

Network Indicators:

Malformed HTTP packets with unusual boundary headers
Unexpected traffic to HTTP server ports

SIEM Query:

source="http_server" AND (event="crash" OR event="memory_error")

📊 Metadata

CVE ID: CVE-2023-28379

CVSS v3 Score: 9.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-119

Published: November 14, 2023

Last Updated: November 4, 2025

🔗 References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738 Exploit,Technical Description,Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1738 Exploit,Technical Description,Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1738

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-28379, you might also want to check these: