PT-2019-14042 · Lierda+1 · Lierda Grill Temperature Monitor+1

Tim Tepatti · Publicado 2019-08-26 · Atualizado 2020-09-24 · CVE-2019-15304

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lierda Grill Temperature Monitor version V1.00 50006 ProGrade Grill Temperature Monitor (affected versions not specified)

Description The issue concerns a default password set to admin for the admin account, allowing potential Denial of Service or Information Disclosure attacks via an undocumented access-point configuration page on the device. The accompanying wifi thermometer app requires excessive permissions, including Fine GPS location, camera, app lists, Serial number, and IMEI. Additionally, the app connects to several China-based URLs, including Alibaba cloud computing. There is also a "backdoor" login access for admin purposes.

Recommendations For Lierda Grill Temperature Monitor version V1.00 50006, consider changing the default admin password to a strong, unique password to prevent unauthorized access. For ProGrade Grill Temperature Monitor, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2019-15304

Produtos afetados

Lierda Grill Temperature Monitor

Prograde Grill Temperature Monitor

Referências · 7

• http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.00_50006-Hardcoded-Credentials.html · Nota
• https://t.me/defcon_news/22842 · Publicação no Telegram
• http://progradegrill.com/wifi-grilling-thermometer · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15304 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15304 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2019/Aug/24 · Nota
• https://joesandbox.com/analysis/287596/0/html · Nota