CVE-2024-58311General

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic key generation process by calculating valid access keys using a simple mathematical transformation of the card's unique identifier.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1245

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

General

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://cvebrief.com/cve/CVE-2024-58311/

Full discourse2 posts

CVE Brief@DailyCVEBrief91d
General
LOOK BACK — Millions of hotel doors keyed their locks off a value every card broadcasts: the UID. Read one expired checkout card, forge a master. CVE-2024-58311 (Unsaflok) rode a cipher broken in 2008 — and got a CVE 21 months after the hack went public. https://t.co/GkWMshuxzw
Post summary
The tweet highlights that hotel doors can be compromised by forging a master key from a card’s UID, referencing CVE-2024-58311 (Unsaflok) that exploits a long‑known cipher weakness, but offers no PoC, patch or evidence of active exploitation.
1000065
21 followersView on X
CVE Brief@DailyCVEBrief91d
Patch
Full Look Back writeup — the UID-seeded key derivation, why the fix is a multi-year door-by-door hardware swap, and the CVE that arrived 21 months late: https://cvebrief.com/cve/CVE-2024-58311/ https://t.co/tCGYyQUiXw
Post summary
The tweet discusses a writeup on CVE‑2024‑58311, pointing out a UID‑seeded key derivation flaw and noting that remediation requires a prolonged, door‑by‑door hardware replacement. No exploits or PoCs are mentioned, but a patch strategy is highlighted.
0000052
21 followersView on X

Explore more

Back to dashboard