CVE-2023-6533 - OpenCVE

Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://community.silabs.com/068Vm000001HdNm

History

Fri, 27 Sep 2024 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-345 CWE-754
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Sep 2024 16:00:00 +0000

Type	Values Removed	Values Added
Description	Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.	Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.
Title	Silicon Labs PC Controller Denial of Service Vulnerability	Silicon Labs PC Controller Denial of Service Vulnerability
Weaknesses		CWE-248 CWE-419

MITRE

Status: PUBLISHED

Assigner: Silabs

Published: 2024-02-21T19:55:26.586Z

Updated: 2024-09-27T15:52:58.406Z

Reserved: 2023-12-05T18:59:45.077Z

Link: CVE-2023-6533

Vulnrichment

Updated: 2024-08-02T08:35:14.652Z

NVD

Status : Awaiting Analysis

Published: 2024-02-21T20:15:46.283

Modified: 2024-09-27T16:15:04.440

Link: CVE-2023-6533

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6533", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2023-12-05T18:59:45.077Z", "datePublished": "2024-02-21T19:55:26.586Z", "dateUpdated": "2024-09-27T15:52:58.406Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "PC Controller", "product": "PC Controller", "repo": "https://github.com/SiliconLabs/gecko_sdk/releases", "vendor": "silabs.com", "versions": [{"lessThanOrEqual": "5.54.0", "status": "affected", "version": "0", "versionType": "LessThan"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier. "}], "value": "Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier."}], "impacts": [{"capecId": "CAPEC-601", "descriptions": [{"lang": "en", "value": "CAPEC-601 Jamming"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "description": "CWE-248 Uncaught Exception", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-419", "description": "CWE-419 Unprotected Primary Channel", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-27T15:52:58.406Z"}, "references": [{"tags": ["vendor-advisory", "permissions-required"], "url": "https://community.silabs.com/068Vm000001HdNm"}], "source": {"discovery": "UNKNOWN"}, "title": "Silicon Labs PC Controller Denial of Service Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T15:48:15.722979Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:54.088Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:35:14.652Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "permissions-required", "x_transferred"], "url": "https://community.silabs.com/068Vm000001HdNm"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://community.silabs.com/068Vm000001HdNm", "tags": ["vendor-advisory", "permissions-required", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:35:14.652Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-22T15:48:15.722979Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.519Z"}}], "cna": {"title": "Silicon Labs PC Controller Denial of Service Vulnerability", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-601", "descriptions": [{"lang": "en", "value": "CAPEC-601 Jamming"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/SiliconLabs/gecko_sdk/releases", "vendor": "silabs.com", "product": "PC Controller", "versions": [{"status": "affected", "version": "0", "versionType": "LessThan", "lessThanOrEqual": "5.54.0"}], "packageName": "PC Controller", "defaultStatus": "unaffected"}], "references": [{"url": "https://community.silabs.com/068Vm000001HdNm", "tags": ["vendor-advisory", "permissions-required"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.", "supportingMedia": [{"type": "text/html", "value": "Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248 Uncaught Exception"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-419", "description": "CWE-419 Unprotected Primary Channel"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-27T15:52:58.406Z"}}}, "cveMetadata": {"cveId": "CVE-2023-6533", "state": "PUBLISHED", "dateUpdated": "2024-09-27T15:52:58.406Z", "dateReserved": "2023-12-05T18:59:45.077Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2024-02-21T19:55:26.586Z", "assignerShortName": "Silabs"}, "dataVersion": "5.1"}