CVE-2024-29916

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-29916", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-19T22:56:01.256Z", "dateReserved": "2024-03-21T00:00:00.000Z", "datePublished": "2024-03-21T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-19T22:56:01.256Z"}, "descriptions": [{"lang": "en", "value": "The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the \"Unsaflok\" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://unsaflok.com"}, {"url": "https://news.ycombinator.com/item?id=39779291"}, {"url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/"}, {"url": "https://www.youtube.com/watch?v=4cx0RUV7i0s"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-407", "lang": "en", "description": "CWE-407 Inefficient Algorithmic Complexity"}]}], "affected": [{"vendor": "dormakaba", "product": "saflok_rt_firmware", "cpes": ["cpe:2.3:o:dormakaba:saflok_rt_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "dormakaba", "product": "saflok_mt_firmware", "cpes": ["cpe:2.3:o:dormakaba:saflok_mt_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "dormakaba", "product": "quantum_firmware", "cpes": ["cpe:2.3:o:dormakaba:quantum_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "dormakaba", "product": "saffire_firmware", "cpes": ["cpe:2.3:o:dormakaba:saffire_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "dormakaba", "product": "confidant_firmware", "cpes": ["cpe:2.3:o:dormakaba:confidant_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-06T04:00:40.628490Z", "id": "CVE-2024-29916", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-19T22:49:13.822Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.598Z"}, "title": "CVE Program Container", "references": [{"url": "https://unsaflok.com", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=39779291", "tags": ["x_transferred"]}, {"url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://unsaflok.com", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=39779291", "tags": ["x_transferred"]}, {"url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.598Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-29916", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-06T04:00:40.628490Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:dormakaba:saflok_rt_firmware:*:*:*:*:*:*:*:*"], "vendor": "dormakaba", "product": "saflok_rt_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:dormakaba:saflok_mt_firmware:*:*:*:*:*:*:*:*"], "vendor": "dormakaba", "product": "saflok_mt_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:dormakaba:quantum_firmware:*:*:*:*:*:*:*:*"], "vendor": "dormakaba", "product": "quantum_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:dormakaba:saffire_firmware:*:*:*:*:*:*:*:*"], "vendor": "dormakaba", "product": "saffire_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:dormakaba:confidant_firmware:*:*:*:*:*:*:*:*"], "vendor": "dormakaba", "product": "confidant_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407 Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-19T22:42:47.305Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://unsaflok.com"}, {"url": "https://news.ycombinator.com/item?id=39779291"}, {"url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/"}, {"url": "https://www.youtube.com/watch?v=4cx0RUV7i0s"}], "descriptions": [{"lang": "en", "value": "The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the \"Unsaflok\" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-19T22:56:01.256Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29916", "state": "PUBLISHED", "dateUpdated": "2024-10-19T22:56:01.256Z", "dateReserved": "2024-03-21T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-03-21T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"cpes": ["cpe:2.3:o:dormakaba:saflok_rt_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "saflok_rt_firmware", "vendor": "dormakaba", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:dormakaba:saflok_mt_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "saflok_mt_firmware", "vendor": "dormakaba", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:dormakaba:quantum_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "quantum_firmware", "vendor": "dormakaba", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:dormakaba:saffire_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "saffire_firmware", "vendor": "dormakaba", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:dormakaba:confidant_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "confidant_firmware", "vendor": "dormakaba", "versions": [{"lessThanOrEqual": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the \"Unsaflok\" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series."}, {"lang": "es", "value": "El sistema dormakaba Saflok antes de la actualizaci\u00f3n de software de noviembre de 2023 permite a un atacante desbloquear puertas arbitrarias en una propiedad mediante tarjetas de acceso falsificadas, si el atacante ha obtenido una tarjeta de acceso activa o vencida para la propiedad espec\u00edfica, tambi\u00e9n conocido como el problema \"Unsaflok\". Esto ocurre, en parte, porque la funci\u00f3n de derivaci\u00f3n de claves se basa \u00fanicamente en un UID. Esto afecta, por ejemplo, a Saflok MT y a las series Confidant, Quantum, RT y Saffire."}], "id": "CVE-2024-29916", "lastModified": "2026-06-17T07:23:21.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.4, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-29916", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-04-06T04:00:40.628490Z", "version": "2.0.3"}}]}, "published": "2024-03-21T17:15:09.897", "references": [{"source": "cve@mitre.org", "url": "https://news.ycombinator.com/item?id=39779291"}, {"source": "cve@mitre.org", "url": "https://unsaflok.com"}, {"source": "cve@mitre.org", "url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/"}, {"source": "cve@mitre.org", "url": "https://www.youtube.com/watch?v=4cx0RUV7i0s"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://news.ycombinator.com/item?id=39779291"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://unsaflok.com"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}