PT-2018-13442 · Q Bee+1 · Qbee Cam+2

Francesco Servida · Publicado 2018-09-18 · Atualizado 2020-08-24 · CVE-2018-16225

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Q Bee MultiSensor Camera versions 4.16.4 and earlier Q Bee Cam application versions 1.0.5 and earlier for Android Swisscom Home application versions 10.7.2 and earlier for Android

Description The issue allows an attacker to reuse cookies and bypass authentication, potentially disabling the camera, by accepting unencrypted network traffic from clients.

Recommendations For QBee MultiSensor Camera versions 4.16.4 and earlier, update to a version that encrypts network traffic to prevent cookie reuse. For QBee Cam application versions 1.0.5 and earlier for Android, update to a version that uses encrypted communication with the camera. For Swisscom Home application versions 10.7.2 and earlier for Android, update to a version that supports secure connections to the camera.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2018-16225

Produtos afetados

Qbee Cam

Q Bee Multisensor Camera

Swisscom Home

Referências · 4

• 🔥 https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2018-16225 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16225 · Nota de Segurança
• https://seclists.org/fulldisclosure/2018/Sep/21 · Nota