CVE-2022-3007CWE-862

Unauthorized Access Vulnerability in Syska SW100 Smartwatch

High · published October 31, 2023

CVSS v3.1
8.1
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth.

Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-10-31T11:18Z
EPSS history
Timeline
  • 31 OCT 11:18Z
    Unauthorized Access Vulnerability in Syska SW100 Smartwatch
    cvelistv5