PT-2017-8674 · Osram Sylvania · Osram Lightify Home

Deral Heiland · Published 2017-04-10 · Updated 2017-04-14 · CVE-2016-5052

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home through 2016-07-26

Description The issue is related to the lack of SSL pinning in the OSRAM SYLVANIA Osram Lightify Home. This means that the device does not properly verify the identity of the server it is communicating with, which could lead to man-in-the-middle attacks.

Recommendations For OSRAM SYLVANIA Osram Lightify Home through 2016-07-26, consider implementing SSL pinning to ensure secure communication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-5052

Affected Products

Osram Lightify Home

References · 3

• 🔥 https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059 · Exploit
• https://osv.dev/vulnerability/CVE-2016-5052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5052 · Security Note