PT-2023-28890 · Zededa · Zededa

Ilay Levi

·

Publicado

2023-09-21

·

Atualizado

2026-02-06

·

CVE-2023-43634

CVSS v3.1

8.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Zededa (affected versions not specified)
Description The issue arises from a change in the configuration partition measurement from PCR 13 to PCR 14, without updating the list of PCRs used for sealing and unsealing the "vault" key. This makes the measurement of PCR 14 redundant and allows an attacker to modify the config partition without triggering the measured boot. As a result, the attacker could gain full control over the device and access the contents of the encrypted "vault".
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Insecure Storage of Sensitive Information

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-522CWE-922

Identificadores relacionados

CVE-2023-43634
GHSA-3WMX-9QWP-H363
GHSA-WC42-FCJP-V8VQ
GO-2026-4432
SUSE-SU-2026:0403-1

Produtos afetados

Zededa