CVE-2023-7017

Vulnerability

The firmware update mechanism in Sciener-based locks lacks authentication or validation for updates delivered over Bluetooth Low Energy (BLE). By sending a challenge request with a command to prepare for an update (instead of an unlock request), an attacker can trigger the lock to accept arbitrary firmware without any integrity check or cryptographic signature [1][2].

Exploitation

An attacker only needs BLE proximity to the lock; no prior authentication or valid virtual key is required. The lock's BLE service responds to challenge frames, and a specially crafted message can instruct the lock to enter firmware update mode. The official description notes that the update command is invoked through the same BLE channel used for normal unlock operations, making the attack straightforward once the protocol is understood [1].

Impact

Successful exploitation gives the attacker full control over all lock functions: they can unlock, lock, or permanently disable the device, and potentially use it as a pivot to compromise other devices on the user's network (e.g., via a gateway). Since the update is entirely unauthenticated, the attacker can install malicious firmware that impersonates normal behavior while exfiltrating data or opening the door on command [2].

Mitigation

As of publication (March 2024), Sciener has not released a patch for this vulnerability. The CERT/CC note lists CVE-2023-7017 as unpatched and recommends that users disable BLE on the lock when not needed, or replace the lock with a vendor that supports signed firmware updates [2]. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog.