CVE-2023-7009

Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
https://www.kb.cert.org/vuls/id/949046

Configurations

No configuration.

History

No history.

Information

Published : 2024-03-15 17:15

Updated : 2026-06-17 06:51

NVD link : CVE-2023-7009

Mitre link : CVE-2023-7009

CVE.ORG link : CVE-2023-7009

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2023-7009", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-7009", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-26T15:09:45.609770Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Sciener", "product": "Kontrol Lux", "versions": [{"status": "affected", "version": "6.5.x", "versionType": "custom", "lessThanOrEqual": "6.5.07"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:sciener:kontrol_lux_firmware:6.5:*:*:*:*:*:*:*"], "vendor": "sciener", "product": "kontrol_lux_firmware", "versions": [{"status": "affected", "version": "6.5", "versionType": "custom", "lessThanOrEqual": "6.5.07"}], "defaultStatus": "unknown"}]}], "published": "2024-03-15T17:15:07.810", "references": [{"url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/", "source": "cret@cert.org"}, {"url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.kb.cert.org/vuls/id/949046", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity."}, {"lang": "es", "value": "Algunas cerraduras basadas en Sciener admiten el procesamiento de mensajes de texto plano a trav\u00e9s de Bluetooth Low Energy, lo que permite pasar comandos maliciosos sin cifrar a la cerradura. Estos comandos maliciosos, de menos de 16 bytes de longitud, ser\u00e1n procesados por la cerradura como si fueran comunicaciones cifradas. Un atacante puede aprovechar a\u00fan m\u00e1s esto para comprometer la integridad del bloqueo."}], "lastModified": "2026-06-17T06:51:51.670", "sourceIdentifier": "cret@cert.org"}