Espressif ESP-IDF up to 5.0.7/5.1.5/5.2.3/5.3.1 ESPTouchV2 Protocol risky encryption

Summaryinfo

A vulnerability classified as problematic was found in Espressif ESP-IDF up to 5.0.7/5.1.5/5.2.3/5.3.1. Affected by this vulnerability is an unknown functionality of the component ESPTouchV2 Protocol Handler. Executing a manipulation can lead to risky encryption. This vulnerability is registered as CVE-2024-53845. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Espressif ESP-IDF up to 5.0.7/5.1.5/5.2.3/5.3.1. It has been declared as problematic. This vulnerability affects an unknown function of the component ESPTouchV2 Protocol Handler. The manipulation with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect confidentiality. CVE summarizes:

ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-53845 since 11/22/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 5.0.8, 5.1.6, 5.2.4 or 5.3.2 eliminates this vulnerability. Applying the patch 4f85a2726e04b737c8646d865b44ddd837b703db is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Espressif

Name

• ESP-IDF

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.3.0
• 5.3.1

License

• open-source

Website

• Product: https://github.com/espressif/esp-idf/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion