PT-2021-17683 · Vizio · Vizio E50X-E1+1

Published 2021-08-02 · Updated 2021-08-11 · CVE-2021-27943

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Vizio P65-F1 version 6.0.31.4-2 Vizio E50x-E1 version 10.0.31.4-2

Description: The pairing procedure used by the Vizio Smart TVs and mobile application is vulnerable to a brute-force attack, allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and configurations. The attack is feasible due to only 10,000 possibilities.

Recommendations: For Vizio P65-F1 version 6.0.31.4-2, consider disabling the pairing procedure until a patch is available. For Vizio E50x-E1 version 10.0.31.4-2, restrict access to the TV settings and configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-27943

Affected Products

Vizio E50X-E1

Vizio P65-F1

References · 7

• 🔥 https://l9group.com/advisories/vizio-tv-mobile-pairing-is-vulnerable-to-brute-force-attacks · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27943 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27943 · Vendor Advisory
• https://vizio.com · Vendor Advisory
• https://t.me/cvenotify/19106 · Telegram Post
• https://t.me/cibsecurity/26705 · Telegram Post
• https://t.me/cvenotify/18552 · Telegram Post