CVE-2023-7009 Vulnerability Details

  /     /     /  

CVE-2023-7009 Metadata Quick Info

CVE Published: 15/03/2024 | CVE Updated: 26/08/2024 | CVE Year: 2023
Source: certcc | Vendor: Sciener | Product: Kontrol Lux
Status : PUBLISHED

---

CVE-2023-7009 Description

Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock\'s integrity.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE-311 Missing Encryption of Sensitive Data
Source: Sciener

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).