There is a heap buffer overflow in Shannon Baseband when processing the Retry-After header in the SIP protocol decoder (IMSPL_SipRetryAfter.c according to the debug strings in the firmware image).
advisories | CVE-2023-29087
Shannon Baseband SIP Retry-After Header Heap Buffer Overflow
