CVE-2023-7003

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-323

Affected software

No affected versions have been published.

Timeline

Published: Mar 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-70046.5The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for conn CVE-2023-70057.5A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilize CVE-2023-70069.1The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks int CVE-2023-70078.2Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unl CVE-2023-70085.9A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when th CVE-2023-70098.2Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passe CVE-2023-70108.8Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2023-70116.5Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents CVE-2023-70129.6Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to insta CVE-2023-70134.7Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security CVE-2023-70147.5The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure i CVE-2023-70156.1The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and