CVE-2023-7007 CVE-2023-7007

2024-03-1517:08:58

certcc

www.cve.org

sciener server

connection validation

impersonation attack

unlock key

cve-2023-7007

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field.

CNA Affected

[
  {
    "vendor": "Sciener",
    "product": "Gateway G2",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.0",
        "versionType": "custom"
      }
    ]
  }
]

References

alephsecurity.com/2024/03/07/kontrol-lux-lock-2/