CVE-2023-4489

Опубликовано: 14 дек. 2023

Источник: nvd

CVSS3: 6.4

CVSS3: 9.8

EPSS Низкий

Описание

The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.

Ссылки

https://github.com/SiliconLabs/gecko_sdk
Third Party Advisory
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1
Permissions Required
https://github.com/SiliconLabs/gecko_sdk
Third Party Advisory
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1
Permissions Required

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:silabs:z\/ip_gateway_sdk:*:*:*:*:*:*:*:*

Версия до 7.18.03 (включая)

EPSS

Процентиль: 71%

0.00692

Низкий

6.4 Medium

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-1279

CWE-908

Связанные уязвимости

GHSA-6jw3-xmj9-qvcw

CVSS3: 6.4

github

около 2 лет назад

EPSS

Процентиль: 71%

0.00692

Низкий

6.4 Medium

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-1279

CWE-908