Scientific Locks Vulnerable to Plaintext Malicious Command Attacks

CVE-2023-7009

What is CVE-2023-7009?

Certain Sciener-based locks are vulnerable to improper input validation via their Bluetooth Low Energy functionality. This weakness allows attackers to send unencrypted commands, which are less than 16 bytes long, to the lock. These commands are mistakenly accepted as encrypted, compromising the lock's security. As a result, unauthorized users could gain control, posing significant risks to users' property and privacy. It is essential for users of Sciener-based locks to be aware of these vulnerabilities to ensure their safety.

References