PT-2024-15176 · Unknown · Sciener-Based Locks

Published 2024-03-15 · Updated 2024-08-26 · CVE-2023-7009

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sciener-based locks (affected versions not specified)

Description The issue allows unencrypted malicious commands to be passed to the lock over Bluetooth Low Energy, as some Sciener-based locks support plaintext message processing. These malicious commands, less than 16 bytes in length, are processed by the lock as if they were encrypted communications, potentially compromising the lock's integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-7009

Affected Products

Sciener-Based Locks

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-7009 · Security Note
• https://twitter.com/CVEnew/status/1768688487258288224 · Twitter Post
• https://t.me/cvenotify/74080 · Telegram Post
• https://kb.cert.org/vuls/id/949046 · Note
• https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2 · Note
• https://twitter.com/VulmonFeeds/status/1768706243835658697 · Twitter Post
• https://t.me/cvenotify/73977 · Telegram Post