PT-2019-14042 · Lierda+1 · Lierda Grill Temperature Monitor+1

Tim Tepatti · Published 2019-08-26 · Updated 2020-09-24 · CVE-2019-15304

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lierda Grill Temperature Monitor version V1.00 50006 ProGrade Grill Temperature Monitor (affected versions not specified)

Description The issue concerns a default password set to admin for the admin account, allowing potential Denial of Service or Information Disclosure attacks via an undocumented access-point configuration page on the device. The accompanying wifi thermometer app requires excessive permissions, including Fine GPS location, camera, app lists, Serial number, and IMEI. Additionally, the app connects to several China-based URLs, including Alibaba cloud computing. There is also a "backdoor" login access for admin purposes.

Recommendations For Lierda Grill Temperature Monitor version V1.00 50006, consider changing the default admin password to a strong, unique password to prevent unauthorized access. For ProGrade Grill Temperature Monitor, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2019-15304

Affected Products

Lierda Grill Temperature Monitor

Prograde Grill Temperature Monitor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-15304 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15304 · Vendor Advisory
• http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.00_50006-Hardcoded-Credentials.html · Note
• https://t.me/defcon_news/22842 · Telegram Post
• http://progradegrill.com/wifi-grilling-thermometer · Note
• http://seclists.org/fulldisclosure/2019/Aug/24 · Note
• https://joesandbox.com/analysis/287596/0/html · Note