Deleted Virtual Keys Can Still Access Lock After Intended Deletion
CVE-2023-6960

7.5HIGH

Key Information:

Vendor

Sciener

Status
Ttlock App
Vendor
CVE Published:
15 March 2024

What is CVE-2023-6960?

The TTLock App contains a vulnerability where virtual keys and settings are only removed on the client side. If these keys are not properly purged, they can retain access to the lock, allowing unauthorized individuals to operate the lock after a deletion has been intended. This presents a significant risk for users relying on the app for secure locking mechanisms.

Affected Version(s)

TTLock App 6.4.5

References

https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.