5.4

CVE-2022-46401

Exploit

The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.

Data is provided by the National Vulnerability Database (NVD)
Microchip ≫ Bm78 Firmware Version1.43
   Microchip ≫ Bm78 Version-
Microchip ≫ Bm83 Firmware Version1.43
   Microchip ≫ Bm83 Version-
Microchip ≫ Rn4870 Firmware Version1.43
   Microchip ≫ Rn4870 Version-
Microchip ≫ Rn4871 Firmware Version1.43
   Microchip ≫ Rn4871 Version-
Microchip ≫ Bm70 Firmware Version1.43
   Microchip ≫ Bm70 Version-
Microchip ≫ Bm71 Firmware Version1.43
   Microchip ≫ Bm71 Version-
Microchip ≫ Wbz451 Firmware Version-
   Microchip ≫ Wbz451 Version-
Microchip ≫ Rn4678 Firmware Version1.43
   Microchip ≫ Rn4678 Version-
Microchip ≫ Bm77 Firmware Version1.43
   Microchip ≫ Bm77 Version-
Microchip ≫ Bm64 Firmware Version1.43
   Microchip ≫ Bm64 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.211
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.4 2.8 2.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.