Vulnerability · Published Jan 20, 2022 · Assigned by CERTVDE
CVE-2021-34600Telenot complex: Insecure AES Key Generation
Medium 5.5
In plain English
A medium-severity security flaw in CompasX from Telenot Electronic GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Telenot Electronic GmbH | CompasX | unspecified – before 32.0 |
Weakness: CWE-335 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N