PT-2020-16661 · Magic Home · Magic Home Pro

Victor Hanna · Published 2020-12-17 · Updated 2021-03-23 · CVE-2020-27199

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magic Home Pro version 1.5.1

Description The Magic Home Pro application allows authentication bypass due to its simple username and password authentication function. An attacker can use enumeration to forge a user-specific token without needing the correct password, thereby gaining access to the mobile application as the victim user.

Recommendations For Magic Home Pro version 1.5.1, consider disabling the authentication function temporarily until a patch is available to prevent exploitation. Restrict access to sensitive features of the application to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-27199

Affected Products

Magic Home Pro

References · 7

• 🔥 https://github.com/9lyph/CVE-2020-27199 · Exploit
• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/magic-home-pro-mobile-application-authentication-bypass-cve-2020-27199 · Exploit
• https://osv.dev/vulnerability/CVE-2020-27199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27199 · Security Note
• https://t.me/secharvester/10784 · Telegram Post
• https://t.me/cibsecurity/20978 · Telegram Post
• https://t.me/cybersecuritytechnologies/2963 · Telegram Post