CERT-InCVELIST:CVE-2022-3007CVE-2022-3007 Unauthorized Access Vulnerability in Syska SW100 Smartwatch
8.1 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
8.3 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
19.0%
The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.
Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Syska SW100 Smartwatch",
"vendor": "Syska Led Lights Pvt Ltd",
"versions": [
{
"lessThanOrEqual": "V2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
]Related
8.1 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
8.3 High
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
19.0%