PT-2019-13492 · Yi · Yi M1 Mirrorless Camera

Publicado 2019-09-06 · Atualizado 2020-08-24 · CVE-2019-13953

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YI M1 Mirrorless Camera version V3.2-cn

Description An authentication bypass issue exists in the Bluetooth Low Energy (BLE) authentication module, allowing an attacker to send a set of BLE commands and trigger the issue. This results in sensitive data leakage, such as personal photos. Additionally, an attacker can control the camera to record or take a picture after bypassing authentication.

Recommendations For YI M1 Mirrorless Camera version V3.2-cn, as a temporary workaround, consider disabling the BLE authentication module until a patch is available. Restrict access to the camera's BLE functionality to minimize the risk of exploitation. Avoid using the camera's BLE features until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2019-13953

Produtos afetados

Yi M1 Mirrorless Camera

Referências · 3

• https://cnvd.org.cn/flaw/show/CNVD-2019-23494 · Nota
• https://osv.dev/vulnerability/CVE-2019-13953 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13953 · Nota de Segurança