CVE-2023-7004

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-940

Affected software

Vendor	Product	Versions
Sciener	TTLock App	>= 6.4.5, <= 6.4.5
sciener	ttlock_app	6.4.5

References

Timeline

Published: Mar 15, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-70057.5A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilize CVE-2023-70069.1The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks int CVE-2023-70078.2Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unl CVE-2023-70085.9A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when th CVE-2023-70098.2Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passe CVE-2023-70108.8Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2023-70116.5Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents CVE-2023-70129.6Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to insta CVE-2023-70134.7Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security CVE-2023-70147.5The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure i CVE-2023-70156.1The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and CVE-2023-70167.8A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local a