PT-2018-13170 · Logitech · Logitech Harmony Hub

Published 2018-12-20 · Updated 2019-10-09 · CVE-2018-15720

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206

Description The issue concerns hard-coded accounts in the XMPP server, allowing remote users to access the local API.

Recommendations For versions prior to 4.15.206, update to version 4.15.206 or later to resolve the issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-15720

Affected Products

Logitech Harmony Hub

References · 3

• 🔥 https://tenable.com/security/research/tra-2018-47 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15720 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15720 · Vendor Advisory