{"id":"CVE-2023-41094","aliases":["EUVD-2023-45614","GHSA-jf7p-xvx5-8827"],"status":"published","title":"Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet","description":"TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration\n\nThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00687,"percentile":0.53185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-672","CWE-772","CWE-940"],"published":"2023-10-04T20:01:16Z","modified":"2026-06-17T06:20:32Z","products":[{"vendor":"silabs","product":"emberznet"},{"vendor":"silicon labs","product":"ember znet"}],"references":[{"url":"https://community.silabs.com/0688Y00000aIPzL","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41094"},{"url":"https://github.com/advisories/GHSA-jf7p-xvx5-8827"}],"sources":{"cve":[{"id":"CVE-2023-41094","title":"Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet","description":"TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration\n\nThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected","status":"published","published":"2023-10-04T20:01:16.25Z","modified":"2024-09-26T21:39:11.67Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-940"],"updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-45614","description":"TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration\n\nThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected","status":"published","published":"2023-10-04T20:01:16Z","modified":"2024-09-26T21:39:11Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:06.341022Z"}],"ghsa":[{"id":"GHSA-jf7p-xvx5-8827","title":"\nTouchLink packets processed after timeout or out of range due to Operation on a Resource after...","description":"\nTouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration\n\nThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected\n\n\n","status":"published","published":"2023-10-04T21:30:22Z","modified":"2024-09-27T00:32:10Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-672","CWE-940"],"updated_at":"2026-11-02T14:58:21.32771Z"}],"nvd":[{"id":"CVE-2023-41094","description":"TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration\n\nThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected","status":"published","published":"2023-10-04T21:15:09.963Z","modified":"2026-06-17T06:20:32.423Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-940","CWE-672","CWE-772"],"updated_at":"2026-11-02T14:08:35.022405Z"}]}}