Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet
CVE-2023-41094

9.8CRITICAL

Key Information:

Vendor

Silicon Labs

Status
Ember Znet
Vendor
CVE Published:
4 October 2023

What is CVE-2023-41094?

A vulnerability in Ember ZNet allows for improper processing of TouchLink packets due to resource management flaws. This can result in devices being added outside of the valid TouchLink range or pairing duration, which could potentially lead to unauthorized access or control. This issue mainly affects versions 7.1.3 to 7.1.5 in the 7.1.x series and versions 7.2.0 to 7.2.3 in the 7.2.x series, while versions 7.3 and later remain unaffected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Ember ZNet 32 bit 7.1.3 <= 7.1.5

Ember ZNet 32 bit 7.2.0 <= 7.2.3

Ember ZNet 32 bit 7.3.0

References

https://community.silabs.com/0688Y00000aIPzL

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.