5.4

CVE-2022-46401

Exploit
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microchip ≫ Bm78 Firmware Version 1.43
   Microchip ≫ Bm78 Version -
Microchip ≫ Bm83 Firmware Version 1.43
   Microchip ≫ Bm83 Version -
Microchip ≫ Rn4870 Firmware Version 1.43
   Microchip ≫ Rn4870 Version -
Microchip ≫ Rn4871 Firmware Version 1.43
   Microchip ≫ Rn4871 Version -
Microchip ≫ Bm70 Firmware Version 1.43
   Microchip ≫ Bm70 Version -
Microchip ≫ Bm71 Firmware Version 1.43
   Microchip ≫ Bm71 Version -
Microchip ≫ Wbz451 Firmware Version -
   Microchip ≫ Wbz451 Version -
Microchip ≫ Rn4678 Firmware Version 1.43
   Microchip ≫ Rn4678 Version -
Microchip ≫ Bm77 Firmware Version 1.43
   Microchip ≫ Bm77 Version -
Microchip ≫ Bm64 Firmware Version 1.43
   Microchip ≫ Bm64 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.66% 0.466
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA-ADP 5.4 2.8 2.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://microchip.com
Product
https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM
Third Party Advisory
Exploit
Technical Description
https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
Third Party Advisory
https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/deviating-behaviors-in-bluetooth-le
Vendor Advisory