Vulnerability · Published Mar 15, 2024 · Assigned by certcc
CVE-2023-7009CVE-2023-7009
High 8.2
In plain English
A high-severity security flaw in Kontrol Lux from Sciener. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sciener | Kontrol Lux | 6.5.x – through 6.5.07 |