PT-2021-9472 · Depstech · Depstech Wifi Digital Microscope

Published 2021-07-15 · Updated 2022-07-12 · CVE-2020-12734

Positive Technologies (AI Summary)

CVSS v2.0

4.8

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions DEPSTECH WiFi Digital Microscope version 3

Description The issue allows remote attackers to change the SSID and password of the device, potentially leading to a ransom demand from the rightful device owner. This is due to the lack of a reset option to Factory Default settings.

Recommendations For DEPSTECH WiFi Digital Microscope version 3, consider restricting access to the device's configuration settings to prevent unauthorized changes to the SSID and password. As a temporary workaround, limit the device's exposure to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-12734

Affected Products

Depstech Wifi Digital Microscope

References · 4

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Depstech%20Microscope%20Smart%20Kid%20Toy.pdf · Exploit
• https://depstech.com/mw001-s02-wifi-usb-digital-microscope · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12734 · Security Note
• https://t.me/cvenotify/18231 · Telegram Post