CVE-2023-7017

CRITICAL

Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock...

Affects 0 products across 1 vendor.

CVSS 3.19.8
EPSS0.3%
Percentile20th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

Sciener locks are vulnerable to unauthorized firmware updates via Bluetooth Low Energy, which can lead to device compromise.

BSID: BS-2024-GLOBAL-179376-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-7017?
Sciener locks are vulnerable to unauthorized firmware updates via Bluetooth Low Energy, which can lead to device compromise.
What is the CVSS score for CVE-2023-7017?
CVE-2023-7017 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2023-7017 actively exploited?
No confirmed active exploitation of CVE-2023-7017 as of 2026-09-25.
How do I remediate CVE-2023-7017?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-7017?
CVE-2023-7017 affects Bluetooth.
Vulnerability Details
CVE IDCVE-2023-7017
BSIDBS-2024-GLOBAL-179376-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-03-15
Last Modified2026-06-17
ICS Relevance0%
SourceNVD
Official Description

Sciener locks' firmware update mechanism do not authenticate or validate firmware updates if passed to the lock through the Bluetooth Low Energy service. A challenge request can be sent to the lock with a command to prepare for an update, rather than an unlock request, allowing an attacker to compromise the device.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can send a challenge request to the lock with a command to prepare for an update, bypassing authentication and validation checks, allowing for the installation of malicious firmware.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Bluetooth — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 944 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash8a7b60295a58e53ba10410c33f96cd67769ec7eb7dd0513a2c6b87e254d6a719b1c970342c21abd7dc974f55117cb6f978714e5d3db9ca8db71e0c012d8d156a
Related CVEs affecting Bluetooth
CVE-2025-9994 9.8 The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does no... CVE-2025-14346 9.8 WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce a... CVE-2020-26559 8.8 Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may p... CVE-2025-32062 8.8 The specific flaw exists within the Bluetooth stack developed by Alps Alpine ... CVE-2011-1265 8.8 The Bluetooth Stack 2.1 in Microsoft Windows Vista SP1 and SP2 and Windows 7 ...
View all Bluetooth CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →