Espressif · Esptouch · CVE-2024-53845
Name of the Vulnerable Software and Affected Versions:
ESPTouch versions prior to 5.3.2
ESPTouch versions prior to 5.2.4
ESPTouch versions prior to 5.1.6
ESPTouch versions prior to 5.0.8
Description:
ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8, resulting in a constant IV of zero. This leads to deterministic encrypted output in AES/CBC mode, potentially causing data leakage. The application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8, which is then transmitted along with the provision data to the provision device.
Recommendations:
To address the issue, upgrade to version 5.3.2 or later for the best protection.
For versions prior to 5.2.4, upgrade to version 5.2.4 or later.
For versions prior to 5.1.6, upgrade to version 5.1.6 or later.
For versions prior to 5.0.8, upgrade to version 5.0.8 or later.
As the issue is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.