Log in Start free

Vulnerability · Published Feb 1, 2023 · Assigned by mitre

CVE-2022-31363

High 8.2

In plain English

A high-severity out-of-bounds write in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N

References