CVE-2023-7009

2024-03-1517:15:07

[email protected]

web.nvd.nist.gov

cve-2023-7009

sciener-based locks

bluetooth low energy

unencrypted commands

security vulnerability

nvd

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock’s integrity.

CNA Affected

[
  {
    "vendor": "Sciener",
    "product": "Kontrol Lux",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.x",
        "lessThanOrEqual": "6.5.07",
        "versionType": "custom"
      }
    ]
  }
]

References

alephsecurity.com/2024/03/07/kontrol-lux-lock-2/