by Kastro
Paper/Archive/CVE-2023-4489

CVE-2023-4489

silabs.com Z/IP Gateway SDK — Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.5.445 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.

Affected

ProductAffectedFixed inSource
Z/IP Gateway SDK≤ 7.18.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Silabs (CNA)6.4CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysiliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000buWj0QAE?operationContext=S1refgithub.com/SiliconLabs/gecko_sdk