<--

Challenge response can be retried indefinitely upon failure

Aleph Research Advisory

Identifier

Severity

High

Product

Sciener Smart Locks

Technical Details

The unlockKey value in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the lock’s integrity. Challenge requests take place during the unlocking process, and contain a random integer between 0 and 65535. Challenge requests can be repeatedly prompted and responded to without any limitations, until the correct integer is discovered. Successfully completing the challenge request provides the unlockKey value that can be used to open the lock.

Timeline

  • 07-Mar-24
    : Public disclosure.
  • 21-Dec-23
    : CVE-2023-7006 assigned.
  • 29-Oct-23
    : Reported.

Posts

Credit