Lucene search

MitreCVE-2022-30904

HistoryFeb 01, 2023 - 9:15 p.m.

CVE-2022-30904

2023-02-0121:15:08

CWE-787

mitre

web.nvd.nist.gov

cve

2022

30904

buffer overflow

bestechnic

bluetooth mesh sdk

bes2300

nvd

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU.

Affected configurations

Nvd

Node

bestechnicbluetooth_mesh_software_development_kitMatch1.0

AND

bestechnicbes2300Match-

VendorProductVersionCPE
bestechnicbluetooth_mesh_software_development_kit1.0cpe:2.3:a:bestechnic:bluetooth_mesh_software_development_kit:1.0:*:*:*:*:*:*:*
bestechnicbes2300-cpe:2.3:h:bestechnic:bes2300:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bestechnic	bluetooth_mesh_software_development_kit	1.0	cpe:2.3:a:bestechnic:bluetooth_mesh_software_development_kit:1.0:::::::*
bestechnic	bes2300	-	cpe:2.3:h:bestechnic:bes2300:-:::::::*

References

docs.google.com/document/d/1is3dYwMcRIkhjvujzi5OgnaGBsQVtlew/edit

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Related for CVE-2022-30904