Sign-up

ID

VAR-202310-2079


CVE

CVE-2023-42189


TITLE

tapo  of  mini smart wi-fi plug  Vulnerability related to inappropriate permission assignment to critical resources in products from multiple vendors such as firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637

DESCRIPTION

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function. tapo of mini smart wi-fi plug Firmware and other products from multiple vendors contain vulnerabilities related to inappropriate permission assignments on critical resources.Service operation interruption (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2023-42189 // JVNDB: JVNDB-2023-014637

AFFECTED PRODUCTS

vendor:switchbotmodel:hub2scope:eqversion:1.0-0.8

Trust: 1.0

vendor:oreinmodel:smart bulbscope:eqversion: -

Trust: 1.0

vendor:phillipsmodel:hue bridgescope:eqversion:1.59.1959097030

Trust: 1.0

vendor:evemodel:door and windowscope:eqversion: -

Trust: 1.0

vendor:tp linkmodel:smart plugscope:eqversion: -

Trust: 1.0

vendor:tapomodel:mini smart wi-fi plugscope:eqversion: -

Trust: 1.0

vendor:yeelightmodel:smart lampscope:eqversion:1.12.69

Trust: 1.0

vendor:nanoleafmodel:lightstripscope:eqversion:3.5.10

Trust: 1.0

vendor:goveemodel:led stripscope:eqversion:3.00.42

Trust: 1.0

vendor:switchbotmodel:hub2scope: - version: -

Trust: 0.8

vendor:yeelightmodel:smart lampscope: - version: -

Trust: 0.8

vendor:tapomodel:mini smart wi-fi plugscope: - version: -

Trust: 0.8

vendor:nanoleafmodel:lightstripscope: - version: -

Trust: 0.8

vendor:evemodel:door and windowscope: - version: -

Trust: 0.8

vendor:tp linkmodel:smart plugscope: - version: -

Trust: 0.8

vendor:goveemodel:led stripscope: - version: -

Trust: 0.8

vendor:phillipsmodel:hue hubscope: - version: -

Trust: 0.8

vendor:oreinmodel:smart bulbscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637 // NVD: CVE-2023-42189

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-42189
value: HIGH

Trust: 1.0

NVD: CVE-2023-42189
value: HIGH

Trust: 0.8

nvd@nist.gov: CVE-2023-42189
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2023-42189
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637 // NVD: CVE-2023-42189

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.0

problemtype:Improper permission assignment for critical resources (CWE-732) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637 // NVD: CVE-2023-42189

EXTERNAL IDS

db:NVDid:CVE-2023-42189

Trust: 2.6

db:JVNDBid:JVNDB-2023-014637

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637 // NVD: CVE-2023-42189

REFERENCES

url:https://github.com/iot-fuzz/iot-fuzz/blob/main/remove%20key%20set%20vulnerability%20report.pdf

Trust: 1.8

url:https://github.com/project-chip/connectedhomeip/issues/28518

Trust: 1.8

url:https://github.com/project-chip/connectedhomeip/issues/28679

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-42189

Trust: 0.8

sources: JVNDB: JVNDB-2023-014637 // NVD: CVE-2023-42189

SOURCES

db:JVNDBid:JVNDB-2023-014637
db:NVDid:CVE-2023-42189

LAST UPDATE DATE

2024-08-14T14:16:52.439000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2023-014637date:2023-12-25T04:28:00
db:NVDid:CVE-2023-42189date:2024-02-15T19:44:54.227

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2023-014637date:2023-12-25T00:00:00
db:NVDid:CVE-2023-42189date:2023-10-10T03:15:09.530