CVE-2023-7004 CVE-2023-7004

2024-03-1517:08:11

certcc

www.cve.org

ttlock app

device verification

spoofed mac address

lock integrity

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

CNA Affected

[
  {
    "vendor": "Sciener",
    "product": "TTLock App",
    "versions": [
      {
        "status": "affected",
        "version": "6.4.5",
        "lessThanOrEqual": "6.4.5",
        "versionType": "custom"
      }
    ]
  }
]

References

alephsecurity.com/2024/03/07/kontrol-lux-lock-2/