PT-2020-19482 · Evoko · Evoko Home

Published 2020-01-19 · Updated 2022-05-03 · CVE-2020-7232

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Evoko Home devices versions 1.31 through 1.37

Description The issue allows remote attackers to obtain sensitive information, such as usernames and password hashes, via a WebSocket request. This can be demonstrated by accessing the sockjs/224/uf1psgff/websocket URI at a wss:// URL.

Recommendations For Evoko Home devices versions 1.31 through 1.37, as a temporary workaround, consider restricting access to the WebSocket endpoint until a patch is available. Avoid using the sensitive information via the WebSocket request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-7232

Affected Products

Evoko Home

References · 5

• 🔥 https://sku11army.blogspot.com/2020/01/evoko-otra-sala-por-favor.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7232 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7232 · Vendor Advisory
• https://t.me/cvenotify/29625 · Telegram Post
• https://t.me/cvenotify/331 · Telegram Post