title: Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devices
description: Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules)
allows potential modification or extraction of network credentials stored in flash.
This issue affects Silicon Labs Ember ZNet SDK: 7.3.1 and earlier.
problem types: CWE-311 Missing Encryption of Sensitive Data
affected:
{
defaultStatus: affected
modules: SecureVault High
platforms: [32 bit, ARM]
product: Ember ZNet SDK
repo: https://github.com/SiliconLabs/gecko_sdk
vendor: silabs.com
versions:
status: unaffected, version: 7.3.2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL