PT-2024-15171 · Kontrol+2 · Kontrol+3

Published 2024-03-07 · Updated 2024-09-25 · CVE-2023-7003

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sciener firmware (affected versions not specified)

Description The issue concerns the use of a non-unique AES key in the pairing process between locks using Sciener firmware and wireless keypads. This key can be reused, potentially compromising other locks that utilize the same firmware. The affected locks include electronic locks such as Kontrol and Elock, which work in conjunction with the TTLock app.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-323

Related Identifiers

CVE-2023-7003

Affected Products

Elock

Kontrol

Sciener Firmware

Ttlock App

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-7003 · Security Note
• https://twitter.com/VulmonFeeds/status/1765762160183976045 · Twitter Post
• https://kb.cert.org/vuls/id/949046 · Note
• https://t.me/cvenotify/74076 · Telegram Post
• https://t.me/cvenotify/73973 · Telegram Post
• https://twitter.com/CVEnew/status/1768690606363017337 · Twitter Post
• https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2 · Note