PT-2024-35948 · Espressif · Esptouch

Nir-Mo · Published 2024-12-11 · Updated 2024-12-13 · CVE-2024-53845

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ESPTouch versions prior to 5.3.2 ESPTouch versions prior to 5.2.4 ESPTouch versions prior to 5.1.6 ESPTouch versions prior to 5.0.8

Description: ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8, resulting in a constant IV of zero. This leads to deterministic encrypted output in AES/CBC mode, potentially causing data leakage. The application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8, which is then transmitted along with the provision data to the provision device.

Recommendations: To address the issue, upgrade to version 5.3.2 or later for the best protection. For versions prior to 5.2.4, upgrade to version 5.2.4 or later. For versions prior to 5.1.6, upgrade to version 5.1.6 or later. For versions prior to 5.0.8, upgrade to version 5.0.8 or later. As the issue is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-909

Related Identifiers

CVE-2024-53845

GHSA-WM57-466G-MHRR

Affected Products

Esptouch

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53845.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53845 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53845 · Vendor Advisory
• https://github.com/espressif/esp-idf/tree/master/components/esp_wifi · Note
• https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr · Note
• https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9 · Note
• https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2 · Note
• https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8 · Note
• https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db · Note
• https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7 · Note
• https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2 · Note
• https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2 · Note
• https://twitter.com/CVEnew/status/1867537648669143444 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1867145200369328526 · Twitter Post