CVE-2023-41094 | TouchLink packets processed after timeout or out of range du… | CVSS 10.0 CRITICAL

Description

TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected

Metadata

CVE ID: CVE-2023-41094
State: PUBLISHED
Assigner: Silabs
Reserved: 2023-08-23 04:17 UTC
Published: 2023-10-04 20:01 UTC
Last updated: 2024-09-26 21:39 UTC
Primary CWE: CWE-940
CWE-940 Improper Verification of Source of a Communication C…
Vendor / Product: Silicon Labs / Ember ZNet
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Silicon Labs	Ember ZNet	32 bit,ARM	7.1.3 ≤ 7.1.5, 7.2.0 ≤ 7.2.3, 7.3.0

Weakness (CWE)

CWE	Source	Description
CWE-940	cna	CWE-940 Improper Verification of Source of a Communication Channel

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

https://community.silabs.com/0688Y00000aIPzL