CVEvulnerability

CVE-2023-41094

9.8 CRITICAL Published 2023-10-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-10-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-672, CWE-772, CWE-940

Description

TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected

Affected configurations

• silabs emberznet (>= 7.1.3 <= 7.1.5) • silabs emberznet (>= 7.2.0 <= 7.2.3)

Related

Weakness · CWE (3)

  • CWE-672 Operation on a Resource after Expiration or Release weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime weakness
  • CWE-940 Improper Verification of Source of a Communication Channel weakness

References