CVE-2023-7005

The TTLock App and locks using Sciener firmware (such as the Kontrol Lux lock , firmware versions 6.5.x to 6.5.07) are vulnerable to an encryption downgrade. A specially crafted message can be sent to the app to downgrade the communication protocol, potentially revealing the unlockKey field. Duri...

CVE-2023-7005 CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005: Undefined Security Weakness

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7006

The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity...

CVE-2023-7007

Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field...

CVE-2023-7007 CVE-2023-7007

Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field...

CVE-2023-7007

The Sciener server fails to validate connection requests from the GatewayG2 , enabling an impersonation attack. An attacker can spoof the MAC address of a GatewayG2 that has established a connection with a lock to intercept messages from the Sciener server. This vulnerability can facilitate unaut...

CVE-2023-7006 CVE-2023-7006

The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity...

CVE-2023-7006 CVE-2023-7006

The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity...

CVE-2023-7007: Undefined Security Weakness

Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field...

Sciener server security vulnerability

Sciener is a smart lock firmware from Sciener. A security vulnerability exists in the Sciener server that stems from not validating connection requests from GatewayG2, which allows an attacker to obtain the unlockKey field via a simulated attack...

PT-2024-15174 · Kontrol +2 · Kontrol +3

Name of the Vulnerable Software and Affected Versions: Sciener firmware affected versions not specified Description: The issue concerns the unlockKey character in locks using Sciener firmware, which can be compromised through brute force attacks by sending repeated challenge requests. This affect...