Unsecured Firmware Update Mechanism Leaves Scientific Locks Vulnerable to Attack

CVE-2023-7017

What is CVE-2023-7017?

The firmware update mechanism of Sciener locks lacks proper authentication and validation for firmware updates sent via Bluetooth Low Energy service. This vulnerability permits an attacker to initiate a challenge request, tricking the lock into preparing for an update instead of processing a legitimate unlock command. Consequently, this flaw can undermine the integrity of the locking mechanism, potentially allowing unauthorized access and control over secured areas.

References