PT-2019-14365 · Eques · Eques Elf Smart Plug

Iamckn · Publicado 2019-08-29 · Atualizado 2019-09-05 · CVE-2019-15745

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:A/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eques elf smart plug (affected versions not specified)

Description The issue concerns the use of a hardcoded AES 256 bit key for encrypting commands and responses between the Eques elf smart plug device and its mobile app. Communication occurs over UDP port 27431. An attacker on the local network can exploit this by using the same key to send encrypted commands, potentially allowing them to discover all smart plugs on the network, gain control of a device, and perform actions like turning it on and off.

Recommendations For the Eques elf smart plug, consider restricting access to UDP port 27431 to minimize the risk of exploitation. As a temporary workaround, limit the discovery and control features of the smart plug until a patch or secure key management system is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-15745

Produtos afetados

Eques Elf Smart Plug

Referências · 6

• 🔥 https://github.com/iamckn/eques · Exploit
• 🔥 https://ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-two · Exploit
• 🔥 https://ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-three · Exploit
• 🔥 https://ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-four · Exploit
• 🔥 https://ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-one · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-15745 · Nota de Segurança