PT-2021-11850 · Libre Wireless · Libre Wireless Ls9 Ls1.5/P7040

Published 2021-05-03 · Updated 2021-05-18 · CVE-2020-35758

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Libre Wireless LS9 LS1.5/p7040 devices

Description: The issue is related to an authentication bypass in the web interface of the affected devices. The web interface does not properly restrict access to internal functionality, allowing direct access to APIs that should not be exposed to an unauthenticated user, despite presenting a password login page on first access.

Recommendations: For Libre Wireless LS9 LS1.5/p7040 devices, restrict access to the web interface until a proper fix is implemented to ensure authentication is required for accessing privileged functionality. As a temporary workaround, consider limiting access to the device's APIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-35758

Affected Products

Libre Wireless Ls9 Ls1.5/P7040

References · 4

• 🔥 https://iot-inspector.com/blog/advisory-multiple-issues-libre-wireless-ls9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35758 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35758 · Vendor Advisory
• https://t.me/cvenotify/13970 · Telegram Post