PT-2017-18324 · 360Fly+1 · 360Fly+1

Published 2017-05-01 · Updated 2019-10-03 · CVE-2017-8403

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 360fly 4K cameras version 2.1.4

Description The issue allows unauthenticated changes to Wi-Fi passwords and provides complete access through REST by exploiting the Bluetooth Low Energy pairing procedure. This procedure is available at any time and does not require a password. Exploitation can be achieved using the 360fly Android or iOS application, or the BlueZ gatttool program.

Recommendations For version 2.1.4, consider disabling the Bluetooth Low Energy pairing procedure until a patch is available to prevent unauthenticated access. Restrict access to the REST interface to minimize the risk of exploitation. Avoid using the 360fly Android or iOS application, or the BlueZ gatttool program, to interact with the camera until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-8403

Affected Products

360Fly

Bluez

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-8403 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8403 · Vendor Advisory
• https://slideshare.net/fuguet/bluediot-when-a-mature-and-immature-technology-mixes-becomes-an-idiot-situation-75529672 · Note