PT-2017-14779 · Google+1 · Android+1

Publicado 2017-12-07 · Atualizado 2017-12-22 · CVE-2017-17436

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:A/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vaultek Gun Safe VT20i products (affected versions not specified)

Description The issue concerns the lack of encryption in the communication session between the Android application and the Vaultek Gun Safe VT20i products. Despite claims of using "Highest Level Bluetooth Encryption" and "Data transmissions are secure via AES256 bit encryption", the communication channel is not encrypted. This is particularly noteworthy because AES256 bit encryption is not supported in the Bluetooth Low Energy (BLE) standard and would need to be implemented at the application level. As a result, an individual can learn the passcode by eavesdropping on the communications between the application and the safe.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-17436

Produtos afetados

Android

Vaultek Gun Safe Vt20I

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17436 · Nota de Segurança
• https://twosixlabs.com/bluesteal-popping-gatt-safes · Nota
• https://vaulteksafe.com/index.php/cve-2017-17435 · Aviso do Fabricante