CVE-2022-3007 Unauthorized Access Vulnerability in Syska SW100 Smartwatch
An unauthenticated attacker can exploit improper DFU configuration to perform firmware updates, reboot, or manipulate data on the smartwatch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3007?
CVE-2022-3007 is a high-severity missing authorization vulnerability in Syska SW100 Smartwatch, published on 31 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.
Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.
Weakness: CWE-862
Which versions are affected by CVE-2022-3007?
It affects 1 product.
Products include Syska Sw100 Smartwatch Firmware.
How do I fix CVE-2022-3007?
No fix has been published for CVE-2022-3007 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3007 being exploited?
There is no known exploitation of CVE-2022-3007 in the wild and no public exploit code.
Sources
Also known as GHSA-7247-9948-8r7q.