Third Party Access to Devices' Information Through Implementation Flaw in Connectivity Standards Alliance Protocol
CVE-2024-3454

3.5LOW

Key Information:

Vendor

Connectivity Standards Alliance

Status
Connectedhomeip
Vendor
CVE Published:
24 July 2024

What is CVE-2024-3454?

An implementation issue in the Matter protocol, as utilized within the connectedhomeip SDK, permits unauthorized third-party access to sensitive information regarding devices within the same fabric. This vulnerability compromises the protocol's designed intent of safeguarding such data, potentially exposing connected devices to tailored attacks that exploit device configuration and active status.

Affected Version(s)

connectedhomeip 1.2.0.1

References

https://www.bitdefender.com/support/security-advisories/i...
third-party-advisory

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bela Genge, Bitdefender
.
CVE-2024-3454 : Third Party Access to Devices' Information Through Implementation Flaw in Connectivity Standards Alliance Protocol