PT-2021-21734 · Microchip · Microchip Miwi

Published 2021-08-05 · Updated 2022-07-12 · CVE-2021-37605

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microchip MiWi software versions prior to 6.5

Description The issue concerns the validation of Message Integrity Check (MIC) bytes in the Microchip MiWi software stack. Specifically, the stack only validates two out of four MIC bytes. Additionally, there is a possibility of frame counters being validated or updated before message authentication, which could lead to security issues.

Recommendations For Microchip MiWi software versions prior to 6.5, update to a version that properly validates all four MIC bytes and ensures message authentication occurs before frame counter validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2021-37605

Affected Products

Microchip Miwi

References · 11

• https://microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol · Vendor Advisory
• https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.51.0.101-readme.pdf · Vendor Advisory
• https://microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads · Vendor Advisory
• https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf · Vendor Advisory
• https://microchip.com/product-change-notifications/# · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37605 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37605 · Vendor Advisory
• https://microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability · Vendor Advisory
• https://t.me/cibsecurity/26888 · Telegram Post
• https://t.me/cvenotify/18710 · Telegram Post
• https://t.me/cvenotify/24753 · Telegram Post