PT-2017-18324 · 360Fly+1 · 360Fly+1

Publicado 2017-05-01 · Atualizado 2019-10-03 · CVE-2017-8403

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 360fly 4K cameras version 2.1.4

Description The issue allows unauthenticated changes to Wi-Fi passwords and provides complete access through REST by exploiting the Bluetooth Low Energy pairing procedure. This procedure is available at any time and does not require a password. Exploitation can be achieved using the 360fly Android or iOS application, or the BlueZ gatttool program.

Recommendations For version 2.1.4, consider disabling the Bluetooth Low Energy pairing procedure until a patch is available to prevent unauthenticated access. Restrict access to the REST interface to minimize the risk of exploitation. Avoid using the 360fly Android or iOS application, or the BlueZ gatttool program, to interact with the camera until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-8403

Produtos afetados

360Fly

Bluez

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-8403 · Nota de Segurança
• https://slideshare.net/fuguet/bluediot-when-a-mature-and-immature-technology-mixes-becomes-an-idiot-situation-75529672 · Nota
• https://osv.dev/vulnerability/CVE-2017-8403 · Aviso do Fabricante