CVE-2022-3007

{"id": "CVE-2022-3007", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "vdisclose@cert-in.org.in"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "vdisclose@cert-in.org.in", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-10-31T12:15:08.597", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0333", "tags": ["Third Party Advisory"], "source": "vdisclose@cert-in.org.in"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "vdisclose@cert-in.org.in", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.\n"}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO EST\u00c1 ASIGNADO ** La vulnerabilidad existe en Syska SW100 Smartwatch debido a una implementaci\u00f3n y/o configuraci\u00f3n incorrecta de la Actualizaci\u00f3n de firmware del dispositivo n\u00f3rdico (DFU) que se utiliza para realizar actualizaciones de firmware por aire (OTA) en Bluetooth Low Dispositivos de energ\u00eda (BLE). Un atacante no autenticado podr\u00eda aprovechar esta vulnerabilidad estableciendo valores arbitrarios para manejar en el dispositivo vulnerable a trav\u00e9s de Bluetooth. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir al atacante realizar actualizaciones de firmware, reiniciar el dispositivo o manipular datos en el dispositivo objetivo."}], "lastModified": "2024-08-03T01:16:12.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:syska:sw100_smartwatch_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53987C98-292E-43E6-ABBF-007AA9422FAB", "versionEndIncluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:syska:sw100_smartwatch:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C036D702-E9F6-4597-8AE6-2B9761035221"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vdisclose@cert-in.org.in"}