PT-2023-12996 · Syska+1 · Syska Sw100 Smartwatch+1

Shakir Zari · Published 2023-10-31 · Updated 2024-08-03 · CVE-2022-3007

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Syska SW100 Smartwatch (affected versions not specified)

Description The issue exists due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) used for Over-The-Air (OTA) firmware updates on Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploitation could allow the attacker to perform firmware update, device reboot, or data manipulation on the target device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-3007

Affected Products

Nordic Device Firmware Update

Syska Sw100 Smartwatch

References · 6

• https://osv.dev/vulnerability/CVE-2022-3007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3007 · Security Note
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333 · Note
• https://t.me/cvenotify/88675 · Telegram Post
• https://t.me/cibsecurity/73226 · Telegram Post
• https://twitter.com/vuldb/status/1719437982472785958 · Twitter Post