Texas Instruments Wi-SUN® Stack: Absence of Frame Counter Validation

Summary

Texas Instruments provides a Wi-SUN® Stack implementing the IEEE® 802.15.4g specifications. The TI Wi-SUN® stack did not include logic to check the frame counter of incoming packets as described in step h of section 9.2.3 of the IEEE® 802.15.4-2020 standard. This allows attackers to capture network packets and resend those packets. The receiving device will process the packet as if it was sent by the original source of the packet.

Vulnerability

TI PSIRT ID

TI-PSIRT-2022-100128

CVE ID:

None

CVSS Score

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS Base score:

4.3

Affected Products

Part	SDK	SDK Version	TI-Wi-SUN-Stack Version
CC1352R, CC1352P7, CC1352P, CC1312R7, CC1312R, CC1200	SIMPLELINK-CC13XX-CC26XX-SDK: SimpleLink™ CC13xx and CC26xx software development kit (SDK)	6.40.00.13 and earlier	1.0.6 and earlier

To determine if your product is impacted, check the version of the TI Wi-SUN® stack built into your product. This can be done by looking at the documentation included with SDK.

Potentially Impacted Features

The failure to correctly validate the frame counter may allow an attacker to replay network packets. The vulnerability does not allow an attacker to decrypt or modify packets.

Suggested Mitigations

Customers are encouraged to upgrade to the latest SDK for their Wi-SUN® product. After obtaining the latest SDK, customers should confirm a TI Wi-SUN® Stack version of 2.10.00 or greater and upgrade their device to use the new version of the stack.

The following SDK releases address these vulnerabilities:

SDK	First SDK version with mitigations	First TI-Wi-SUN-Stack Version with mitigations
SIMPLELINK-CC13XX-CC26XX-SDK: SimpleLink™ CC13xx and CC26xx software development kit (SDK)	7.10	2.10.00

External References

IEEE® Std 802.15.4-2020, IEEE Standard for Low-Rate Wireless Networks, July 2020.

Wi-SUN® Alliance, Technical Profile Specification Field Area Network, Version 1v33

Revision History

Version 1.0 initial publication

IMPORTANT NOTICE AND DISCLAIMER

TI PROVIDES TECHNICAL AND RELIABILITY DATA (INCLUDING DATASHEETS), DESIGN RESOURCES (INCLUDING REFERENCE DESIGNS), APPLICATION OR OTHER DESIGN ADVICE, WEB TOOLS, SAFETY INFORMATION, AND OTHER RESOURCES “AS IS” AND WITH ALL FAULTS, AND DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS.

These resources are intended for skilled developers designing with TI products. You are solely responsible for (1) selecting the appropriate TI products for your application, (2) designing, validating and testing your application, and (3) ensuring your application meets applicable standards, and any other safety, security, or other requirements. These resources are subject to change without notice. TI grants you permission to use these resources only for development of an application that uses the TI products described in the resource. Other reproduction and display of these resources is prohibited. No license is granted to any other TI intellectual property right or to any third party intellectual property right. TI disclaims responsibility for, and you will fully indemnify TI and its representatives against, any claims, damages, costs, losses, and liabilities arising out of your use of these resources.

TI’s products are provided subject to TI’s Terms of Sale (www.ti.com/legal/termsofsale.html) or other applicable terms available either on ti.com or provided in conjunction with such TI products. TI’s provision of these resources does not expand or otherwise alter TI’s applicable warranties or warranty disclaimers for TI products.

Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265