Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2023-43637

7.8 · HIGH

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".

Published Sep 21, 2023CWE-321EPSS 0.14%

Overview

CVE-2023-43637 is a high-severity vulnerability. It was published on September 21, 2023 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key

would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".

This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always

return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte

randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys").

This makes the key a lot weaker.

This issue does not persist in devices that were initialized on/after version 7.10, but devices

that were initialized before that and updated to a newer version still have this issue.

Roll an update that enforces the full 32bytes key usage.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refasrg.io/security-advisories/cve-2023-43637/Refasrg.io/security-advisories/cve-2023-43637/

How CyberStrike helps

Frequently asked questions

What is CVE-2023-43637?

CVE-2023-43637 is a high-severity vulnerability. It was published on September 21, 2023 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2023-43637?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2023-43637?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2023-43637?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2023-43637 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2023

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999