9.8
CVE-2023-4489
- EPSS 0.69%
- Published 14.12.2023 23:15:07
- Last modified 21.11.2024 08:35:16
- Source product-security@silabs.com
- Teams watchlist Login
- Open Login
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.
Data is provided by the National Vulnerability Database (NVD)
Silabs ≫ Z/ip Gateway Sdk Version <= 7.18.03
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.69% | 0.71 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| product-security@silabs.com | 6.4 | 0.5 | 5.9 |
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
CWE-908 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.