PT-2022-27855 · Microchip · Rn4870+1

Published 2022-12-19 · Updated 2022-12-27 · CVE-2022-46403

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microchip RN4870 module firmware version 1.43 Microchip PIC LightBlue Explorer Demo version 4.2 DT100112

Description The issue is related to the mishandling of reject messages in the firmware. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Microchip RN4870 module firmware version 1.43, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microchip PIC LightBlue Explorer Demo version 4.2 DT100112, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2022-46403

Affected Products

Pic Lightblue Explorer Demo

Rn4870

References · 9

• 🔥 https://computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM · Exploit
• https://microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/deviating-behaviors-in-bluetooth-le · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46403 · Security Note
• https://t.me/cvenotify/40210 · Telegram Post
• https://microchip.com · Note
• https://t.me/cvenotify/40200 · Telegram Post
• https://computer.org/csdl/proceedings/sp/2023/1He7WWuJExG · Note
• https://t.me/cibsecurity/54939 · Telegram Post