Veracode Vulnerability DatabaseVERACODE:43612Improper Provisioning
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
20.7%
libzephyr.so is vulnerable to Improper Provisioning. The vulnerability arises from an insecure implementation of the provisionee in the prov_pub_key function of prov_device.c within the Bluetooth component. If the provisionee has a public key sent out-of-band (OOB), it can be sent back during provisioning and will be accepted.
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
20.7%