PT-2020-8642 · Unknown · Juuko K-808

Akira Urano + 6 · Published 2020-11-02 · Updated 2022-08-25 · CVE-2018-19025

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: JUUKO K-808 versions prior to numbers ending ...9A, ...9B, ...9C, etc.

Description: The issue allows remote attackers to execute commands on vulnerable installations of the equipment. No authentication is required to exploit this issue. The flaw lies in the handling of data between the transmitter and receiver. By using a fixed control code used for encoding data transmitted over radio frequency, an attacker can spoof unauthorized commands to the receiver. This can be used to send commands to physical equipment controlled by the device.

Recommendations: For versions prior to numbers ending ...9A, ...9B, ...9C, etc., consider restricting access to the device until a patch is available. As a temporary workaround, avoid using the fixed control code for encoding data transmitted over radio frequency until the issue is resolved.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2018-19025

ZDI-18-1362

Affected Products

Juuko K-808

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-19025 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1362 · Security Note
• https://t.me/poxek/2363 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01 · Note