Skip to content
Sign in
6.4 Medium

CVE-2023-4489 The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP…

Description

The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.

Affected products and versions

Product Affected versions Fixed in
Z/IP Gateway SDK 7.18 earliest → 7.18.3 No fix stated

Other CVEs of Z/IP Gateway SDK

The 3 CVEs of Z/IP Gateway SDK →
CVE-2024-3052 Malformed S2 Nonce Get command classes can be sent to crash the gateway 7.5 High CVE-2024-3051 Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device 7.5 High
Track this CVE