Lucene search

SilabsCVELIST:CVE-2023-0971

HistoryJun 21, 2023 - 7:42 p.m.

CVE-2023-0971 Command Authentication Bypass in Z/IP Gateway

2023-06-2119:42:25

CWE-863

CWE-281

CWE-269

Silabs

www.cve.org

logic error

remote administration

z-wave controller

encryption key

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Z/IP Gateway",
    "vendor": "Silicon Labs",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.18.03"
      }
    ]
  }
]

References

siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

Related for CVELIST:CVE-2023-0971