PT-2023-12996 · Syska+1 · Syska Sw100 Smartwatch+1

Shakir Zari · Publicado 2023-10-31 · Atualizado 2024-08-03 · CVE-2022-3007

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Syska SW100 Smartwatch (affected versions not specified)

Description The issue exists due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) used for Over-The-Air (OTA) firmware updates on Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploitation could allow the attacker to perform firmware update, device reboot, or data manipulation on the target device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2022-3007

Produtos afetados

Nordic Device Firmware Update

Syska Sw100 Smartwatch

Referências · 6

• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333 · Nota
• https://t.me/cvenotify/88675 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-3007 · Aviso do Fabricante
• https://t.me/cibsecurity/73226 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3007 · Nota de Segurança
• https://twitter.com/vuldb/status/1719437982472785958 · Publicação no Twitter