HOMEVULNERABILITIESCVE-2023-42189
HIGH

CVE-2023-42189

CWE-732Published: October 10, 2023· Updated: Jun 17, 2026

7.5
CVSS v3.1

Official Description

Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function.

NVD Source

Technical Analysis

CVE-2023-42189 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Vendors & Products

eve2 product(s)
eve door and window firmwareeve door and window
govee2 product(s)
led strip firmwareled strip
nanoleaf2 product(s)
lightstrip firmwarelightstrip
orein2 product(s)
smart bulb firmwaresmart bulb
phillips2 product(s)
hue bridge firmwarehue bridge
switchbot2 product(s)
hub2 firmwarehub2
tapo2 product(s)
mini smart wi-fi plug firmwaremini smart wi-fi plug
tp-link2 product(s)
smart plug firmwaresmart plug
yeelight2 product(s)
smart lamp firmwaresmart lamp
Source: NVD CPE · 18 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdf
ADVISORYhttps://github.com/project-chip/connectedhomeip/issues/28518
ADVISORYhttps://github.com/project-chip/connectedhomeip/issues/28679
ADVISORYhttps://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdf
ADVISORYhttps://github.com/project-chip/connectedhomeip/issues/28518
ADVISORYhttps://github.com/project-chip/connectedhomeip/issues/28679

All References (6)

→
https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdfThird Party Advisory
→
https://github.com/project-chip/connectedhomeip/issues/28518Issue Tracking · Third Party Advisory
→
https://github.com/project-chip/connectedhomeip/issues/28679Issue Tracking · Third Party Advisory
→
https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdfThird Party Advisory
→
https://github.com/project-chip/connectedhomeip/issues/28518Issue Tracking · Third Party Advisory
→
https://github.com/project-chip/connectedhomeip/issues/28679Issue Tracking · Third Party Advisory

Quick Facts

CVE IDCVE-2023-42189
CVSS Score7.5 / 10
SeverityHIGH
WeaknessCWE-732
CISA KEVNo
Affected9 vendor(s)
PublishedOct 10, 2023

Related CVEs (CWE-732)

CVE-2014-125121
10.0
CVE-2026-9508
10.0
CVE-2025-12004
10.0
CVE-2026-32048
9.9
CVE-2021-33509
9.9
CVE-2023-40622
9.9

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2023-42189 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2023-42189·NVD