CVE-2023-4258 - bt: mesh: vulnerability in provisioning protocol implementation on provisionee side

Back Back to CVE browser

HIGH

bt: mesh: vulnerability in provisioning protocol implementation on provisionee side

Published Sep 25, 2023

8.6

HIGH

CVSS 3.1

EPSS 0.57%

Description

In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.

Affected products

Vendor Zephyrproject-Rtos Product Zephyr Default
unaffected
- Version
  1.14
  Status
  affected
  Constraints
  <=3.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zephyrproject-Rtos

Zephyr

unaffected

Version	Status	Constraints
1.14	affected	<=3.4

Vendor Zephyrproject Product Zephyr Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <3.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zephyrproject

Zephyr

n/a

Version	Status	Constraints
0	affected	<3.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-684

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54129
Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7
PatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54129		Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7		PatchThird Party Advisory