PT-2016-5155 · Comcast · Comcast Xfinity Home Security System

Art Manion + 2 · Published 2016-02-17 · Updated 2016-03-04 · CVE-2016-2398

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Comcast XFINITY Home Security System (affected versions not specified)

Description The issue arises from the system's failure to properly maintain base-station communication, allowing physically proximate attackers to interfere with ZigBee 2.4 GHz transmissions and defeat sensor functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-2398

Affected Products

Comcast Xfinity Home Security System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-2398 · Security Note
• http://kb.cert.org/vuls/id/418072 · Note
• https://community.rapid7.com/community/infosec/blog/2016/01/05/r7-2015-23-comcast-xfinity-home-security-system-insecure-fail-open · Note
• http://wired.com/2016/01/xfinitys-security-system-flaws-open-homes-to-thieves · Note