MiWi™ Software Vulnerability
Overview
MiWi™ software vulnerabilities were identified in the handling of message authenticity and replay protection within affected versions of the MiWi protocol stack. Under specific conditions, an attacker capable of transmitting specially crafted wireless traffic to a target network may be able to interfere with message validation processes, which can result in denial-of-service conditions, reduced protection against replay attacks or weakened message authentication. Exploitation requires access to the wireless network environment and the ability to send malicious protocol messages to affected devices.
Vulnerabilities Covered
This page addresses the following vulnerabilities identified by Common Vulnerabilities and Exposures (CVEs):
- CVE-2021-37604: A message-processing vulnerability that may allow an attacker to manipulate frame counter handling before message authentication is completed, potentially leading to denial-of-service conditions or reduced protection against replay attacks
- CVE-2021-37605: A message-authentication vulnerability where only a subset of Message Integrity Check (MIC) bytes is validated, potentially reducing the effectiveness of message authentication protections
Affected Products and Resolution
Products Not Listed
Only products listed in the Affected Products and Resolution section of this advisory are known to be affected by these vulnerabilities.
Credits
Special thanks to Szymon Heidrich of Carrier Global Corporation for reporting this vulnerability.