PT-2018-13171 · Logitech · Logitech Harmony Hub

Published 2018-12-20 · Updated 2019-10-09 · CVE-2018-15721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206

Description The issue concerns an authentication bypass vulnerability in the XMPP server of the Logitech Harmony Hub. This vulnerability can be exploited by remote attackers using a crafted XMPP request to gain unauthorized access to the local API.

Recommendations For versions prior to 4.15.206, update to version 4.15.206 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-15721

Affected Products

Logitech Harmony Hub

References · 3

• 🔥 https://tenable.com/security/research/tra-2018-47 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15721 · Security Note