OpenCVE

Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Silabs	Gecko Software Development Kit

Configuration 1 [-]

cpe:2.3:a:silabs:gecko_software_development_kit:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://community.silabs.com/069Vm000000WXaOIAW
https://github.com/SiliconLabs/gecko_sdk

History

Wed, 25 Sep 2024 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:silabs:gecko_software_development_kit:-:::::::*
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 25 Sep 2024 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-312

MITRE

Status: PUBLISHED

Assigner: Silabs

Published: 2024-02-05T17:39:43.291Z

Updated: 2024-09-25T16:10:32.932Z

Reserved: 2023-12-15T17:44:27.312Z

Link: CVE-2023-6874

Vulnrichment

Updated: 2024-08-02T08:42:08.108Z

NVD

Status : Modified

Published: 2024-02-05T18:15:51.877

Modified: 2024-09-25T16:15:09.773

Link: CVE-2023-6874

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6874", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2023-12-15T17:44:27.312Z", "datePublished": "2024-02-05T17:39:43.291Z", "dateUpdated": "2024-09-25T16:10:32.932Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "GSDK", "vendor": "silabs.com", "versions": [{"lessThan": "7.4.0", "status": "affected", "version": "0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number"}], "value": "Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number"}], "impacts": [{"capecId": "CAPEC-194", "descriptions": [{"lang": "en", "value": "CAPEC-194 Fake the Source of Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-25T16:10:32.932Z"}, "references": [{"url": "https://github.com/SiliconLabs/gecko_sdk"}, {"url": "https://community.silabs.com/069Vm000000WXaOIAW"}], "source": {"discovery": "UNKNOWN"}, "title": "Zigbee Unauthenticated DoS via NWK Sequence number manipulation", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "silabs", "product": "gecko_software_development_kit", "cpes": ["cpe:2.3:a:silabs:gecko_software_development_kit:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.4.0", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-28T17:46:32.895534Z", "id": "CVE-2023-6874", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T17:48:00.169Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:42:08.108Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/SiliconLabs/gecko_sdk", "tags": ["x_transferred"]}, {"url": "https://community.silabs.com/069Vm000000WXaOIAW", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/SiliconLabs/gecko_sdk", "tags": ["x_transferred"]}, {"url": "https://community.silabs.com/069Vm000000WXaOIAW", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:42:08.108Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6874", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-28T17:46:32.895534Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:silabs:gecko_software_development_kit:-:*:*:*:*:*:*:*"], "vendor": "silabs", "product": "gecko_software_development_kit", "versions": [{"status": "affected", "version": "0", "lessThan": "7.4.0", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-28T17:47:55.494Z"}}], "cna": {"title": "Zigbee Unauthenticated DoS via NWK Sequence number manipulation", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-194", "descriptions": [{"lang": "en", "value": "CAPEC-194 Fake the Source of Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "silabs.com", "product": "GSDK", "versions": [{"status": "affected", "version": "0.0", "lessThan": "7.4.0", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/SiliconLabs/gecko_sdk"}, {"url": "https://community.silabs.com/069Vm000000WXaOIAW"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number", "supportingMedia": [{"type": "text/html", "value": "Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2024-09-25T16:10:32.932Z"}}}, "cveMetadata": {"cveId": "CVE-2023-6874", "state": "PUBLISHED", "dateUpdated": "2024-09-25T16:10:32.932Z", "dateReserved": "2023-12-15T17:44:27.312Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2024-02-05T17:39:43.291Z", "assignerShortName": "Silabs"}, "dataVersion": "5.1"}