PT-2021-21733 · Microchip · Microchip Miwi

Published 2021-08-05 · Updated 2022-07-12 · CVE-2021-37604

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microchip MiWi versions prior to 6.5

Description The issue allows an attacker to potentially increment incoming frame counter values by injecting messages with a sufficiently large frame counter value and invalid payload, resulting in denial of service or valid packets in the network. There is also a possibility of a replay attack in the stack.

Recommendations For versions prior to 6.5, consider implementing additional validation checks for frame counters to ensure they are updated after message authentication, as a temporary workaround to minimize the risk of exploitation. Restrict access to the network to prevent attackers from injecting malicious messages.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2021-37604

Affected Products

Microchip Miwi

References · 10

• https://microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37604 · Security Note
• https://microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads · Vendor Advisory
• https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf · Vendor Advisory
• https://microchip.com/product-change-notifications/# · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37604 · Vendor Advisory
• https://microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability · Vendor Advisory
• https://t.me/cvenotify/18711 · Telegram Post
• https://t.me/cvenotify/24754 · Telegram Post
• https://t.me/cibsecurity/26885 · Telegram Post