Reused AES Key Vulnerability Affects Sciener Locks and Wireless Keypads
CVE-2023-7003

6.8MEDIUM

Key Information:

Vendor

Sciener

Status
Kontrol Lux
Vendor
CVE Published:
15 March 2024

What is CVE-2023-7003?

The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.

Affected Version(s)

Kontrol Lux 6.5.x <= 6.5.07

References

https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.