Vulnerability Description
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tapo | Mini Smart Wi-Fi Plug Firmware | - |
| Tapo | Mini Smart Wi-Fi Plug | - |
| Nanoleaf | Lightstrip Firmware | 3.5.10 |
| Nanoleaf | Lightstrip | - |
| Govee | Led Strip Firmware | 3.00.42 |
| Govee | Led Strip | - |
| Switchbot | Hub2 Firmware | 1.0-0.8 |
| Switchbot | Hub2 | - |
| Phillips | Hue Bridge Firmware | 1.59.1959097030 |
| Phillips | Hue Bridge | - |
| Yeelight | Smart Lamp Firmware | 1.12.69 |
| Yeelight | Smart Lamp | - |
| Tp-Link | Smart Plug Firmware | - |
| Tp-Link | Smart Plug | - |
| Orein | Smart Bulb Firmware | - |
| Orein | Smart Bulb | - |
| Eve | Eve Door And Window Firmware | - |
| Eve | Eve Door And Window | - |
Related Weaknesses (CWE)
References
- https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20VulnerabilitThird Party Advisory
- https://github.com/project-chip/connectedhomeip/issues/28518Issue TrackingThird Party Advisory
- https://github.com/project-chip/connectedhomeip/issues/28679Issue TrackingThird Party Advisory
- https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20VulnerabilitThird Party Advisory
- https://github.com/project-chip/connectedhomeip/issues/28518Issue TrackingThird Party Advisory
- https://github.com/project-chip/connectedhomeip/issues/28679Issue TrackingThird Party Advisory
FAQ
What is CVE-2023-42189?
CVE-2023-42189 is a vulnerability with a CVSS score of 7.5 (HIGH). Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue h...
How severe is CVE-2023-42189?
CVE-2023-42189 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42189?
Check the references section above for vendor advisories and patch information. Affected products include: Tapo Mini Smart Wi-Fi Plug Firmware, Tapo Mini Smart Wi-Fi Plug, Nanoleaf Lightstrip Firmware, Nanoleaf Lightstrip, Govee Led Strip Firmware.