PT-2020-20728 · Rubetek · Rubetek Smarthome 2020

Ilya Shaposhnikov · Published 2020-03-04 · Updated 2020-03-06 · CVE-2020-9550

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rubetek SmartHome 2020 devices

Description The issue concerns the use of unencrypted 433 MHz communication between controllers and beacons in Rubetek SmartHome 2020 devices. This allows an attacker to remotely sniff and spoof beacon requests.

Recommendations For Rubetek SmartHome 2020 devices, consider implementing encryption for the 433 MHz communication between controllers and beacons to prevent sniffing and spoofing of beacon requests.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-9550

Affected Products

Rubetek Smarthome 2020

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-9550 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9550 · Vendor Advisory
• https://rubetek.com · Vendor Advisory
• https://pastebin.com/CckKKJcM · Note