CVE-2021-37604
In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters bein
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters being validated/updated prior to the message authentication. With this vulnerability in place, an attacker may increment the incoming frame counter values by injecting messages with a sufficiently large frame counter value and invalid payload. This results in denial of service/valid packets in the network. There is also a possibility of a replay attack in the stack.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 5
microchip.com
- product-change-notifications#/
- en-us/products/wireless-connectivity/sub-ghz/miwi-protocol
- en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads
- en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability