CVE-2023-41095 Vulnerability Details

  /     /     /  

CVE-2023-41095 Metadata Quick Info

CVE Published: 26/10/2023 | CVE Updated: 25/09/2024 | CVE Year: 2023
Source: Silabs | Vendor: silabs.com | Product: OpenThread SDK
Status : PUBLISHED

---

CVE-2023-41095 Description

Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier.

Metrics

CVSS Version: 3.1 | Base Score: 6.8 MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* PHYSICAL
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-312
CWE Name: CWE-312 Cleartext Storage of Sensitive Information
Source: silabs.com

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-458
CAPEC Description: CAPEC-458 Flash Memory Attacks


Source: NVD (National Vulnerability Database).