PT-2017-14604 · Amazon · Amazon Key+1

Ben Caudill · Published 2017-11-16 · Updated 2019-10-03 · CVE-2017-16867

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Amazon Key through 2017-11-16

Description The issue makes it easier for delivery drivers or attackers to freeze a camera and enter a house. This can occur if a delivery driver fails to ensure a locked door before leaving or if an attacker exploits the mishandling of Cloud Cam 802.11 deauthentication frames during the delivery process.

Recommendations For Amazon Key through 2017-11-16, ensure that delivery drivers always lock the door before leaving the house to minimize the risk of exploitation. Additionally, consider implementing an alternative security measure to monitor and secure the premises until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-16867

Affected Products

Amazon Key

Cloud Cam

References · 6

• https://osv.dev/vulnerability/CVE-2017-16867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16867 · Security Note
• https://wired.com/story/amazon-key-flaw-let-deliverymen-disable-your-camera · Note
• https://theverge.com/2017/11/16/16665064/amazon-key-camera-disable · Note
• http://securityfocus.com/bid/101899 · Note
• https://engadget.com/2017/11/16/amazon-key-hack-cloud-cam · Note