CVE-2023-41095

Published Oct 26, 2023

Last updated 7 months ago

CVSS critical 9.1

Overview

Description: Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier.
Source: product-security@silabs.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-311
product-security@silabs.com: CWE-312

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:silabs:openthread_sdk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "47C5EEB8-47DD-41A3-B529-96DAC105C5C4",
            "versionEndIncluding": "2.3.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References