« Volver al listado

CVE-2023-51392

Estado: AnalizadaCrítica (9.8)—

Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Silabs — Emberznet

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-51392",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-51392",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-25T17:59:54.322798Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "product-security@silabs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@silabs.com",
      "affectedData": [
        {
          "repo": "https://github.com/SiliconLabs/gecko_sdk/releases",
          "vendor": "silabs.com",
          "product": "Ember ZNet SDK",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "lessThan": "7.4.0",
              "versionType": "7.x"
            }
          ],
          "platforms": [
            "32 bit",
            "ARM"
          ],
          "packageName": "Ember ZNet SDK",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-02-23T17:15:07.840",
  "references": [
    {
      "url": "https://community.silabs.com/068Vm000001BKm6",
      "tags": [
        "Permissions Required"
      ],
      "source": "product-security@silabs.com"
    },
    {
      "url": "https://community.silabs.com/068Vm000001BKm6",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-security@silabs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1240"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks."
    },
    {
      "lang": "es",
      "value": "Ember ZNet entre v7.2.0 y v7.4.0 utilizó software AES-CCM en lugar de aceleradores criptográficos de hardware integrados, lo que potencialmente aumenta el riesgo de ataques de canal lateral de análisis de potencia diferencial y electromagnético."
    }
  ],
  "lastModified": "2026-06-17T06:40:52.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silabs:emberznet:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E456A82A-F19A-4C1C-B775-8D3D61447EE6",
              "versionEndIncluding": "7.2.4",
              "versionStartIncluding": "7.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@silabs.com"
}