PT-2023-27781 · Silicon · Openthread Sdk

Published 2023-10-26 · Updated 2024-09-25 · CVE-2023-41095

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Silicon Labs OpenThread SDK versions 2.3.1 and earlier

Description The issue affects the Silicon Labs OpenThread SDK on 32-bit, ARM (SecureVault High modules), allowing potential modification or extraction of network credentials stored in flash due to missing encryption of security keys.

Recommendations For versions 2.3.1 and earlier, update to a version later than 2.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the network credentials stored in flash until a patch is available.

Fix

Missing Encryption of Sensitive Data

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-311

CWE-312

Related Identifiers

CVE-2023-41095

Affected Products

Openthread Sdk

References · 7

• https://osv.dev/vulnerability/CVE-2023-41095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41095 · Security Note
• https://t.me/cvenotify/96007 · Telegram Post
• https://twitter.com/CVEnew/status/1717536108018327705 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1717581695619137690 · Twitter Post
• https://t.me/cibsecurity/72975 · Telegram Post
• https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1 · Note