CVE-2023-41096

Published Oct 26, 2023

Last updated 2 months ago

CVSS medium 6.1

Overview

Description: Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier.
Source: product-security@silabs.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 5.2
Exploitability score: 0.9
Vector string: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-311
product-security@silabs.com: CWE-312

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:silabs:emberznet_sdk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B33DB8D2-920F-4929-9C3F-E50CB6E11489",
            "versionEndIncluding": "7.3.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References