CVE-2023-7009 CVE-2023-7009
Attackers can send unencrypted Bluetooth commands to Sciener locks, bypassing encryption to compromise lock integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7009?
CVE-2023-7009 is a high-severity vulnerability in Sciener Kontrol Lux, published on 15 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.
Which versions are affected by CVE-2023-7009?
How do I fix CVE-2023-7009?
No fix has been published for CVE-2023-7009 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-7009 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7009 exists.
Sources
Also known as GHSA-h62x-f726-fw3q.