CVE-2023-26941:

Yale Conexis L1 v1.1.0 RFID tags use weak encryption that allows attackers to create cloned tags when in physical proximity to the original.

Score
A numerical rating that indicates how dangerous this vulnerability is.

6.5Medium

Published Date:Dec 5, 2023
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:11%

Exploitability

Score:2.8
Attack Vector:ADJACENT_NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:NONE
Integrity Impact:HIGH
Availability Impact:NONE

Description Preview

Yale Conexis L1 v1.1.0 RFID tags use weak encryption that allows attackers to create cloned tags when in physical proximity to the original.

Overview

This vulnerability (CWE-326: Inadequate Encryption Strength) affects the Yale Conexis L1 v1.1.0 smart lock system, specifically its RFID tag implementation. The weak encryption used in these tags allows attackers to capture and clone tag data when they are in physical proximity to a legitimate tag. The vulnerability poses a significant security risk as it undermines the access control mechanism of the smart lock system. An attacker with temporary access to a legitimate RFID tag could clone it and later use the cloned tag to gain unauthorized entry without the knowledge of authorized users or administrators. This vulnerability essentially defeats the purpose of using RFID technology as a secure access control method.

Remediation

Users of Yale Conexis L1 v1.1.0 should take the following steps to mitigate this vulnerability:
1. Contact Yale for firmware updates that strengthen the encryption mechanisms of the RFID system.
2. Consider implementing additional security measures such as multi-factor authentication where possible.
3. Physically protect legitimate RFID tags from unauthorized access to prevent cloning attempts.
4. Regularly audit access logs for any suspicious activities.
5. Consider upgrading to newer versions of the lock system if available, which may have addressed this vulnerability.
6. Monitor Yale's security advisories for official patches or hardware replacements.
7. Implement physical security controls to complement electronic access controls.