« Volver al listado

CVE-2023-7004

Estado: AplazadaMedia (6.5)—

The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ttlock — Ttlock APPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-7004",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-7004",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-18T18:47:46.273560Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Sciener",
          "product": "TTLock App",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.5",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.5"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sciener:ttlock_app:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sciener",
          "product": "ttlock_app",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.5"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-15T17:15:07.677",
  "references": [
    {
      "url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/",
      "source": "cret@cert.org"
    },
    {
      "url": "https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/949046",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-940"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity."
    },
    {
      "lang": "es",
      "value": "La aplicación TTLock no emplea procedimientos de verificación adecuados para garantizar que se esté comunicando con el dispositivo esperado, lo que permite la conexión a un dispositivo que falsifica la dirección MAC de un candado, lo que compromete la integridad de los candados legítimos."
    }
  ],
  "lastModified": "2026-06-17T06:51:50.940",
  "sourceIdentifier": "cret@cert.org"
}