General Security Recommendations: We strongly recommend the following industry cybersecurity best practices. * Passwords should include upper case, lower case, number and special characters, a length of 20 characters is ideal. * A default Admin password must be changed immediately when first received and after a factory reset. * Device should only be used in a personal home network. * Device should not have a publicly accessible IP address. * Do NOT use port forwarding to access a device from the public internet. * A device should be on its own network segment. If your router supports a guest network or VLAN, it is preferable to locate the device there. * Use the strongest Wi-Fi encryption available, such as WPA3 or WPA2/3 with protected management frames. * Schedule regular reboots of your routing device, smartphones, and computers. * Ensure that unauthorized individuals cannot gain physical access to your devices (USB or LAN ports should be easily accessible. For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices https://www.se.com/us/en/download/document/7EN52-0390/ document.
For More Information: This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: Schneider Electric
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-4041 | CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 9.8 Critical |
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass. This issue affects "Standalone" and "Application" versions of Gecko Bootloader. Vendor fix: The Wiser AvatarOn 6K Freelocate and Wiser Cuadro H 5P Socket products have reached their end of life and are no longer supported. Users should immediately either disable the firmware update in the Zigbee Trust Center or remove the products from service to re… Mitigation: To stay informed about all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-4041 | 9.8 Critical | Silicon Labs Gecko Bootloader Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability i… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.