CVE-2023-42143

Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is updated with the manipulated firmware.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:shelly:trv_firmware:2.1.8:*:*:*:*:*:*:*
cpe:2.3:h:shelly:trv:-:*:*:*:*:*:*:*

History

31 Jan 2024, 16:57

Type Values Removed Values Added
CPE cpe:2.3:o:shelly:trv_firmware:2.1.8:*:*:*:*:*:*:*
cpe:2.3:h:shelly:trv:-:*:*:*:*:*:*:*
References () https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219 - () https://www.kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219 - Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4
CWE CWE-354
First Time Shelly trv Firmware
Shelly trv
Shelly

23 Jan 2024, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-23 20:15

Updated : 2024-02-28 20:54


NVD link : CVE-2023-42143

Mitre link : CVE-2023-42143

CVE.ORG link : CVE-2023-42143


JSON object : View

Products Affected

shelly

  • trv_firmware
  • trv
CWE
CWE-354

Improper Validation of Integrity Check Value