by Kastro
Paper/Archive/CVE-2023-41095

CVE-2023-41095

silabs.com OpenThread SDK — Keys Stored in Plaintext on Secure Vault High for Silabs OpenThread devices

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 16.0.160 × 203.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1 and earlier.

Affected

ProductAffectedFixed inSource
OpenThread SDKsee advisory2.3.2CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Silabs (CNA)6.8CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsiliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000ZkKh7QAF?operationContext=S1