CVE-2023-51395 - Vulnerability Details - OpenCVE

ReportizFlow

The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Silabs	Z-wave Software Development Kit

No data.

No data.

References

Link	Providers
https://community.silabs.com/068Vm0000029Xq5

History

Wed, 25 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Silabs Silabs z-wave Software Development Kit
CPEs		cpe:2.3:h:silabs:z-wave_software_development_kit::::::::
Vendors & Products		Silabs Silabs z-wave Software Development Kit
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 25 Sep 2024 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-120

Wed, 25 Sep 2024 16:15:00 +0000

Type	Values Removed	Values Added
Description	The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.	The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
Weaknesses		CWE-125 CWE-787

MITRE

Status: PUBLISHED

Assigner: Silabs

Published: 2024-03-07T04:50:54.651Z

Updated: 2024-09-25T16:03:46.409Z

Reserved: 2023-12-18T20:56:24.812Z

Link: CVE-2023-51395

Vulnrichment

Updated: 2024-08-02T22:32:09.186Z

NVD

Status : Awaiting Analysis

Published: 2024-03-07T05:15:53.373

Modified: 2024-11-21T08:38:01.377

Link: CVE-2023-51395

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-51395", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2023-12-18T20:56:24.812Z", "datePublished": "2024-03-07T04:50:54.651Z", "dateUpdated": "2024-09-25T16:03:46.409Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "packageName": "Z-Wave SDK", "platforms": ["ARM", "32 bit"], "product": "Z-Wave SDK", "repo": "https://github.com/SiliconLabs/gecko_sdk/releases", "vendor": "Silicon Labs", "versions": [{"status": "unaffected", "version": "7.20.0"}, {"status": "unaffected", "version": "7.19.3"}, {"status": "unaffected", "version": "7.18.8"}, {"status": "unaffected", "version": "7.17.5"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.</span>"}], "value": "The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution."}], "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-25T16:03:46.409Z"}, "references": [{"url": "https://community.silabs.com/068Vm0000029Xq5"}], "source": {"discovery": "UNKNOWN"}, "title": "Z-Wave S0 Decryption Vulnerability in End Devices", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:32:09.186Z"}, "title": "CVE Program Container", "references": [{"url": "https://community.silabs.com/068Vm0000029Xq5", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "silabs", "product": "z-wave_software_development_kit", "cpes": ["cpe:2.3:h:silabs:z-wave_software_development_kit:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "0", "status": "unaffected", "lessThan": "7.17.5", "versionType": "custom"}, {"version": "7.18.0", "status": "unaffected", "lessThan": "7.18.8", "versionType": "custom"}, {"version": "7.19.0", "status": "unaffected", "lessThan": "7.19.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-27T16:36:30.844451Z", "id": "CVE-2023-51395", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T16:44:12.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://community.silabs.com/068Vm0000029Xq5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:32:09.186Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-51395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-27T16:36:30.844451Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:silabs:z-wave_software_development_kit:*:*:*:*:*:*:*:*"], "vendor": "silabs", "product": "z-wave_software_development_kit", "versions": [{"status": "unaffected", "version": "0", "lessThan": "7.17.5", "versionType": "custom"}, {"status": "unaffected", "version": "7.18.0", "lessThan": "7.18.8", "versionType": "custom"}, {"status": "unaffected", "version": "7.19.0", "lessThan": "7.19.3", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T16:44:00.538Z"}}], "cna": {"title": "Z-Wave S0 Decryption Vulnerability in End Devices", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-549", "descriptions": [{"lang": "en", "value": "CAPEC-549 Local Execution of Code"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/SiliconLabs/gecko_sdk/releases", "vendor": "Silicon Labs", "product": "Z-Wave SDK", "versions": [{"status": "unaffected", "version": "7.20.0"}, {"status": "unaffected", "version": "7.19.3"}, {"status": "unaffected", "version": "7.18.8"}, {"status": "unaffected", "version": "7.17.5"}], "platforms": ["ARM", "32 bit"], "packageName": "Z-Wave SDK", "defaultStatus": "affected"}], "references": [{"url": "https://community.silabs.com/068Vm0000029Xq5"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-25T16:03:46.409Z"}}}, "cveMetadata": {"cveId": "CVE-2023-51395", "state": "PUBLISHED", "dateUpdated": "2024-09-25T16:03:46.409Z", "dateReserved": "2023-12-18T20:56:24.812Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2024-03-07T04:50:54.651Z", "assignerShortName": "Silabs"}, "dataVersion": "5.1"}