CVE-2023-42189

Published: Oct 10, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function.

Affected (9)

Products: Tapo: Mini Smart Wi Fi Plug Firmware · Nanoleaf: Lightstrip Firmware · Govee: Led Strip Firmware · +6 more

Show all products

Tapo: Mini Smart Wi Fi Plug Firmware · Nanoleaf: Lightstrip Firmware · Govee: Led Strip Firmware · Switchbot: Hub2 Firmware · Phillips: Hue Bridge Firmware · Yeelight: Smart Lamp Firmware · Tp Link: Smart Plug Firmware · Orein: Smart Bulb Firmware · Eve: Eve Door And Window Firmware

Tapo

1 product

Mini Smart Wi Fi Plug Firmware

1 product

1 product

1 product

1 product

1 product

1 product

1 product

1 product

Eve Door And Window Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tapo Mini Smart Wi Fi Plug Firmware	All versions

Running on/with	Platform Versions
Tapo Mini Smart Wi Fi Plug	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nanoleaf Lightstrip Firmware	Version 3.5.10

Running on/with	Platform Versions
Nanoleaf Lightstrip	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Govee Led Strip Firmware	Version 3.00.42

Running on/with	Platform Versions
Govee Led Strip	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Switchbot Hub2 Firmware	Version 1.0-0.8

Running on/with	Platform Versions
Switchbot Hub2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phillips Hue Bridge Firmware	Version 1.59.1959097030

Running on/with	Platform Versions
Phillips Hue Bridge	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Yeelight Smart Lamp Firmware	Version 1.12.69

Running on/with	Platform Versions
Yeelight Smart Lamp	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Smart Plug Firmware	All versions

Running on/with	Platform Versions
Tp Link Smart Plug	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Orein Smart Bulb Firmware	All versions

Running on/with	Platform Versions
Orein Smart Bulb	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Eve Eve Door And Window Firmware	All versions

Running on/with	Platform Versions
Eve Eve Door And Window	All versions

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (6)

https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdf

Source: cve@mitre.org

Third Party Advisory

https://github.com/project-chip/connectedhomeip/issues/28518

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/project-chip/connectedhomeip/issues/28679

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/project-chip/connectedhomeip/issues/28518

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/project-chip/connectedhomeip/issues/28679

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.