CVE-2023-4489 Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key
Predictable S0 encryption keys due to uninitialized PRNG allow unauthorized network access in Z/IP Gateway products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4489?
CVE-2023-4489 is a medium-severity vulnerability in silabs.com Z/IP Gateway SDK, published on 14 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.
Which versions are affected by CVE-2023-4489?
It affects 1 product.
Products include Silabs Z\/Ip Gateway Sdk.
How do I fix CVE-2023-4489?
No fix has been published for CVE-2023-4489 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4489 being exploited?
There is no known exploitation of CVE-2023-4489 in the wild and no public exploit code.
Other vulnerabilities in silabs.com Z/IP Gateway SDK
Sources
Also known as GHSA-6jw3-xmj9-qvcw.