CVE-2023-4258: bt: mesh: vulnerability in provisioning protocol implementation on provisionee side
Published Sep 25, 2023
·Updated
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
Affected Software
1 affected component
zephyrproject zephyr<3.4.0
Remediation
Event History
Sep 25, 2023
CVE Published
via MITRE·09:46 PM
Data Sourced
via MITRE·09:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-4258.
2
What is the severity of CVE-2023-4258?
CVE-2023-4258 has a severity rating of 6.5 (high).
3
Which software versions are affected by CVE-2023-4258?
The Zephyrproject Zephyr software versions up to exclusive version 3.4.0 are affected by CVE-2023-4258.
4
What is the Common Weakness Enumeration (CWE) ID of CVE-2023-4258?
CVE-2023-4258 has a CWE ID of 684.
5
Where can I find more information about CVE-2023-4258?
You can find more information about CVE-2023-4258 in the following link: [CVE-2023-4258](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-m34c-cp63-rwh7).