You do not have permission to edit this page, for the following reasons:
The Nanoleaf Lightstrip is a Matter and Thread smart LED strip. Two CVEs list the lightstrip in their CPE configurations. CVE-2023-42189 (CVSS 7.5) is notable because it is an insecure-permissions flaw in the Connectivity Standards Alliance Matter SDK v1.1.0.0 itself, affecting the lightstrip at firmware 3.5.10 together with devices from other vendors; that makes it a protocol-level weakness rather than a Nanoleaf-specific coding error. CVE-2023-45955 (CVSS 7.5) allows denial of service against the same firmware via crafted write-binding attribute commands. What keeps the impact bounded is the device class: a lightstrip controls lighting only, so a compromise affects illumination and whatever home network it reaches, not physical safety or surveillance. Matter and Thread do encrypt traffic at the protocol level, which is the one criterion that scores well here. The device is rated C, and the arithmetic is worth making explicit. The System category sums to 2 + 1 + 3 = 6, an average of 2.0 that rounds up to 2, because Matter and Thread encryption scores favourably while storage does not. The Device category is also 2, and User Authentication is 3. That gives a GRAS of 7, which maps to C. The rating is not lower because two CVSS 7.5 flaws are documented against this exact model, one of them in the Matter SDK itself; it is not higher because neither flaw yields unauthenticated full device takeover, no exploitation campaign was found, and a lightstrip controls lighting only. Several values, notably storage encryption, account management and logging, are provisional because no model-level Nanoleaf documentation could be retrieved.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
