CVE-2024-29916

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

21/03/2024

Last modified:

19/10/2024

Description

The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.

Impact

Vector 3.x

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.60 MEDIUM
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector (AV): Physical
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): None

Base Score 3.x

5.60

Severity 3.x

MEDIUM

CVE-2024-29916

Description

Impact

References to Advisories, Solutions, and Tools