CVE-2023-7009
Last modified
CVE-2023-7009 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-7009?
How severe is CVE-2023-7009?
How do I fix CVE-2023-7009?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-7003The AES key utilized in the pairing process between a lock u…6.8
- CVE-2023-7004The TTLock App does not employ proper verification procedure…6.5
- CVE-2023-7005A specially crafted message can be sent to the TTLock App th…7.5
- CVE-2023-7006The unlockKey character in a lock using Sciener firmware can…9.1
- CVE-2023-7007Sciener server does not validate connection requests from th…8.2
- CVE-2023-7008A vulnerability was found in systemd-resolved. This issue ma…5.9
- CVE-2023-7010Use after free in WebRTC in Google Chrome prior to 117.0.593…8.8
- CVE-2023-7011Inappropriate implementation in Picture in Picture in Google…6.5
- CVE-2023-7012Insufficient data validation in Permission Prompts in Google…9.6
- CVE-2023-7013Inappropriate implementation in Compositing in Google Chrome…4.7
- CVE-2023-7014The Author Box, Guest Author and Co-Authors for Your Posts –…7.5
- CVE-2023-7015The File Manager Pro plugin for WordPress is vulnerable to R…6.1
Are you affected by CVE-2023-7009?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST