CVE-2024-29916

The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.
Configurations

No configuration.

History

21 Nov 2024, 09:08

Type Values Removed Values Added
References () https://news.ycombinator.com/item?id=39779291 - () https://news.ycombinator.com/item?id=39779291 -
References () https://unsaflok.com - () https://unsaflok.com -
References () https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/ - () https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/ -

19 Oct 2024, 23:15

Type Values Removed Values Added
References
  • () https://www.youtube.com/watch?v=4cx0RUV7i0s -

03 Jul 2024, 01:52

Type Values Removed Values Added
Summary
  • (es) El sistema dormakaba Saflok antes de la actualización de software de noviembre de 2023 permite a un atacante desbloquear puertas arbitrarias en una propiedad mediante tarjetas de acceso falsificadas, si el atacante ha obtenido una tarjeta de acceso activa o vencida para la propiedad específica, también conocido como el problema "Unsaflok". Esto ocurre, en parte, porque la función de derivación de claves se basa únicamente en un UID. Esto afecta, por ejemplo, a Saflok MT y a las series Confidant, Quantum, RT y Saffire.
CWE CWE-407
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.6

21 Mar 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-03-21 17:15

Updated : 2024-11-21 09:08


NVD link : CVE-2024-29916

Mitre link : CVE-2024-29916

CVE.ORG link : CVE-2024-29916


JSON object : View

Products Affected

No product.

CWE
CWE-407

Inefficient Algorithmic Complexity