CVE-2022-3007 HIGH

CVE-2022-3007: Unauthorized Access Vulnerability in Syska SW100 Smartwatch

Vendor Syska Led Lights Pvt Ltd
Product Syska SW100 Smartwatch
Weakness CWE-862 · Missing authorization
Published October 31, 2023
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unauthenticated attacker could exploit this vulnerability by setting arbitrary values to handle on the vulnerable device over Bluetooth. Successful exploitation of this vulnerability could allow the attacker to perform firmware update, device reboot or data manipulation on the target device.

Key dates

02Disclosure timeline

October 31, 2023 CVE published
August 3, 2024 Record updated