PT-2021-17681 · Ewelink · Ewelink

Daniele Granata + 3 · Published 2021-05-06 · Updated 2022-07-12 · CVE-2021-27941

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: eWeLink mobile application versions 4.9.2 and earlier on Android eWeLink mobile application versions 4.9.1 and earlier on iOS

Description: The issue allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during a device pairing process, due to unconstrained Web access to the device's private encryption key in the QR code pairing mode.

Recommendations: For eWeLink mobile application versions 4.9.2 and earlier on Android, update to a version later than 4.9.2 to resolve the issue. For eWeLink mobile application versions 4.9.1 and earlier on iOS, update to a version later than 4.9.1 to resolve the issue. As a temporary workaround, consider restricting the use of the QR code pairing mode until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-27941

Affected Products

Ewelink

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-27941 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27941 · Vendor Advisory
• https://github.com/salgio/eWeLink-QR-Code · Note
• https://apps.apple.com/us/app/ewelink-smart-home/id1035163158 · Note
• https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US · Note
• https://t.me/cvenotify/14193 · Telegram Post