CVE-2023-26941

Vulnerability

The Yale Conexis L1 Smart Lock firmware version 1.1.0 uses weak encryption mechanisms for its RFID tag authentication. The encryption is insufficient to prevent cloning, allowing an attacker to capture the tag data and create a duplicate. [1]

Exploitation

An attacker with physical proximity to an authorized RFID tag can use a compatible reader to capture the tag's response during a legitimate authentication attempt or by scanning the tag. The weak encryption allows the attacker to extract the necessary data to program a blank RFID tag, effectively cloning the original. [1]

Impact

Successful exploitation enables the attacker to unlock the Yale Conexis L1 Smart Lock using the cloned tag, bypassing the intended access control. This compromises the physical security of the premises where the lock is installed. [1]

Mitigation

As of the publication of the technical report (November 2023), no firmware update or patch has been publicly released by Yale to address this vulnerability. Users are advised to monitor for updates from the vendor and consider additional physical security measures. [1]