Vulnerability · Published Oct 4, 2023 · Assigned by Silabs
CVE-2023-41094Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet
Critical 10.0
In plain English
A critical-severity security flaw in Ember ZNet from Silicon Labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Silicon Labs | Ember ZNet | 7.1.3 – through 7.1.57.2.0 – through 7.2.3 |
Weakness: CWE-940 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H