{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-3007", "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c", "state": "PUBLISHED", "assignerShortName": "CERT-In", "dateReserved": "2022-08-26T09:47:49.013Z", "datePublished": "2023-10-31T11:18:23.411Z", "dateUpdated": "2024-08-03T00:53:00.582Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Syska SW100 Smartwatch", "vendor": "Syska Led Lights Pvt Ltd", "versions": [{"lessThanOrEqual": "V2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability is reported by Shakir Zari from Payatu Security Consulting Pvt Ltd., Maharashtra, India."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.<br><br>Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.<br>"}], "value": "The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Apply mitigations as per vendor instructions or discontinue use of the product if mitigations are unavailable."}], "value": "Apply mitigations as per vendor instructions or discontinue use of the product if mitigations are unavailable."}], "source": {"discovery": "UNKNOWN"}, "tags": ["unsupported-when-assigned"], "title": "Unauthorized Access Vulnerability in Syska SW100 Smartwatch", "providerMetadata": {"orgId": "66834db9-ab24-42b4-be80-296b2e40335c", "shortName": "CERT-In", "dateUpdated": "2023-10-31T11:18:23.411Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:53:00.582Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:syska:sw100_smartwatch_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "53987C98-292E-43E6-ABBF-007AA9422FAB", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:syska:sw100_smartwatch:-:*:*:*:*:*:*:*", "matchCriteriaId": "C036D702-E9F6-4597-8AE6-2B9761035221", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "vdisclose@cert-in.org.in", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.\n"}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO EST\u00c1 ASIGNADO ** La vulnerabilidad existe en Syska SW100 Smartwatch debido a una implementaci\u00f3n y/o configuraci\u00f3n incorrecta de la Actualizaci\u00f3n de firmware del dispositivo n\u00f3rdico (DFU) que se utiliza para realizar actualizaciones de firmware por aire (OTA) en Bluetooth Low Dispositivos de energ\u00eda (BLE). Un atacante no autenticado podr\u00eda aprovechar esta vulnerabilidad estableciendo valores arbitrarios para manejar en el dispositivo vulnerable a trav\u00e9s de Bluetooth. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir al atacante realizar actualizaciones de firmware, reiniciar el dispositivo o manipular datos en el dispositivo objetivo."}], "id": "CVE-2022-3007", "lastModified": "2024-11-21T07:18:37.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "vdisclose@cert-in.org.in", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-31T12:15:08.597", "references": [{"source": "vdisclose@cert-in.org.in", "tags": ["Third Party Advisory"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333"}], "sourceIdentifier": "vdisclose@cert-in.org.in", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "vdisclose@cert-in.org.in", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}