CVE-2021-37605

Description

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check (MIC) bytes.

References

https://www.microchip.com/product-change-notifications/#/

https://www.microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol

https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability

https://www.microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads

https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.51.0.101-readme.pdf

https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24163

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS