CVE-2021-37605

HIGH 7.5CVE-2021-37605 · Published 05/08/2021 · updated 17/06/2026

In short

CVE-2021-37605 is a HIGH (CVSS 7.5) vulnerability affecting miwi (microchip).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
miwi microchip	`= 6.5`	No fix yet

Description

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check (MIC) bytes.

References

ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf · Vendor Advisory
ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.51.0.101-readme.pdf · Release Notes
microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices · Vendor Advisory
microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability · Vendor Advisory
microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol · Vendor Advisory
microchip.com/product-change-notifications · Vendor Advisory

More vulnerabilities in miwi

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free