PT-2019-12246 · Tzumi Electronics · Klic Lock+1

Kerry Enfinger · Publicado 2019-06-11 · Atualizado 2023-03-24 · CVE-2019-11334

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tzumi Electronics Klic Lock application version 1.0.9 Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2

Description The issue allows attackers to bypass authentication in website post requests, enabling them to access resources that would otherwise require proper authentication. This can be achieved through capture-replay by physically proximate attackers, potentially leading to unauthorized access to the Tzumi Electronics Klic Smart Padlock.

Recommendations For Tzumi Electronics Klic Lock application version 1.0.9, update the application to a version that addresses the authentication bypass issue. For Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2, update the firmware to a version that resolves the vulnerability.

Exploit

Correção

Enumeração de Fraquezas

CWE-294

Identificadores relacionados

CVE-2019-11334

Produtos afetados

Klic Lock

Klic Smart Padlock

Referências · 4

• 🔥 https://github.com/whitehatdefenses/KlicUnLock · Exploit
• 🔥 http://packetstormsecurity.com/files/153280/Tzumi-Electronics-Klic-Lock-Authentication-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11334 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11334 · Nota de Segurança