CVE-2023-4489

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-4489
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.

6.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/SiliconLabs/gecko_sdk Third Party Advisory
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 Permissions Required
https://github.com/SiliconLabs/gecko_sdk Third Party Advisory
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:silabs:z\/ip_gateway_sdk:*:*:*:*:*:*:*:*
History

21 Nov 2024, 08:35

Type Values Removed Values Added
References () https://github.com/SiliconLabs/gecko_sdk - Third Party Advisory () https://github.com/SiliconLabs/gecko_sdk - Third Party Advisory
References () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 - Permissions Required () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 - Permissions Required
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 6.4

27 Sep 2024, 17:15

Type Values Removed Values Added
Summary (en) The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access. (en) The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.
CWE CWE-1279

28 Dec 2023, 20:26

Type Values Removed Values Added
CWE CWE-908
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 - () https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1 - Permissions Required
References () https://github.com/SiliconLabs/gecko_sdk - () https://github.com/SiliconLabs/gecko_sdk - Third Party Advisory
CPE cpe:2.3:a:silabs:z\/ip_gateway_sdk:*:*:*:*:*:*:*:*

14 Dec 2023, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 23:15

Updated : 2024-11-21 08:35

NVD link : CVE-2023-4489

Mitre link : CVE-2023-4489

CVE.ORG link : CVE-2023-4489

JSON object : View

Products Affected

silabs

  • z\/ip_gateway_sdk
CWE
CWE-1279

Cryptographic Operations are run Before Supporting Units are Ready

CWE-908

Use of Uninitialized Resource