PT-2020-12392 · Oklok+1 · Oklok+1

Published 2020-05-04 · Updated 2020-05-15 · CVE-2020-10876

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OKLOK version 3.1.1 Fingerprint Bluetooth Padlock FB50 version 2.3

Description The issue arises from the incorrect implementation of the timeout on the four-digit verification code required for resetting passwords, and the lack of proper restriction on excessive verification attempts. This allows an attacker to brute force the four-digit verification code, bypass email verification, and change the password of a victim account.

Recommendations For OKLOK version 3.1.1, consider implementing a proper timeout on the four-digit verification code and restrict excessive verification attempts to prevent brute force attacks. For Fingerprint Bluetooth Padlock FB50 version 2.3, restrict access to the password reset feature until a proper fix is implemented to prevent unauthorized password changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Insufficient Session Expiration

Weakness Enumeration

CWE-307

CWE-613

Related Identifiers

CVE-2020-10876

Affected Products

Fingerprint Bluetooth Padlock Fb50

Oklok

References · 5

• 🔥❌ https://github.com/fierceoj/ownklok · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2020-10876 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10876 · Vendor Advisory
• https://t.me/cvenotify/3514 · Telegram Post
• https://apps.apple.com/us/app/oklok/id1392287771 · Note