CVE-2023-7004

Published: Mar 15, 2024Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

Related CWEs

CWE-940

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (3)

https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/

Source: cret@cert.org

https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.kb.cert.org/vuls/id/949046

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.