PT-2018-13043 · Mystrom · Mystrom Wifi Button Plus+6
Almeroth
+1
·
Publicado
2018-08-30
·
Atualizado
2019-10-03
·
CVE-2018-15478
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
myStrom WiFi Switch V1 versions prior to 2.66
myStrom WiFi Switch V2 versions prior to 3.80
myStrom WiFi Switch EU versions prior to 3.80
myStrom WiFi Bulb versions prior to 2.58
myStrom WiFi LED Strip versions prior to 3.80
myStrom WiFi Button versions prior to 2.73
myStrom WiFi Button Plus versions prior to 2.73
Description
An issue was discovered where the registration process of devices with a cloud account was based on an activation code derived from the device MAC address. This allowed an attacker to register previously unregistered devices to their account by guessing valid MAC addresses or using MAC addresses printed on devices in shops and reverse engineering the protocol. As a result, when the rightful owner connected the devices to their WiFi network, the devices would not register with their account and would not be controllable from the owner's mobile app.
Recommendations
For myStrom WiFi Switch V1 versions prior to 2.66, update to version 2.66 or later.
For myStrom WiFi Switch V2 versions prior to 3.80, update to version 3.80 or later.
For myStrom WiFi Switch EU versions prior to 3.80, update to version 3.80 or later.
For myStrom WiFi Bulb versions prior to 2.58, update to version 2.58 or later.
For myStrom WiFi LED Strip versions prior to 3.80, update to version 3.80 or later.
For myStrom WiFi Button versions prior to 2.73, update to version 2.73 or later.
For myStrom WiFi Button Plus versions prior to 2.73, update to version 2.73 or later.
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mystrom Wifi Bulb
Mystrom Wifi Button
Mystrom Wifi Button Plus
Mystrom Wifi Led Strip
Mystrom Wifi Switch Eu
Mystrom Wifi Switch V1
Mystrom Wifi Switch V2