PT-2022-22877 · Unknown · Blink1Control2

P1Ckzi · Published 2022-09-07 · Updated 2023-08-08 · CVE-2022-35513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blink1Control2 versions prior to 2.2.9

Description The issue concerns the use of weak password encryption and an insecure method of storage in the Blink1Control2 application.

Recommendations For versions prior to 2.2.9, update to version 2.2.9 to resolve the issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-327

CWE-326

CWE-922

Related Identifiers

CVE-2022-35513

GHSA-JQHQ-PFG3-FG5P

Affected Products

Blink1Control2

References · 13

• 🔥 https://github.com/p1ckzi/CVE-2022-35513 · Exploit
• 🔥 http://packetstormsecurity.com/files/168428/Blink1Control2-2.2.7-Weak-Password-Encryption.html · Exploit
• 🔥 https://exploit-db.com/exploits/51014 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35513 · Security Note
• https://osv.dev/vulnerability/GHSA-jqhq-pfg3-fg5p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35513 · Vendor Advisory
• https://github.com/todbot/Blink1Control2/releases · Note
• https://github.com/todbot/Blink1Control2 · Note
• https://github.com/todbot/Blink1Control2/issues/175 · Note
• https://github.com/todbot/Blink1Control2/commit/74827462aba3a26d7bf157522f69eec999d7ba85 · Note
• https://github.com/todbot/Blink1Control2/commit/efe174823f67bbdcee8863e02df67a130f132075 · Note
• https://github.com/todbot/Blink1Control2/commit/cd9229ef9131bc663f714150c9f8d5cbf818d620 · Note
• https://github.com/todbot/Blink1Control2/commit/f595d782d2356878188fed423a7dcb84ee8fee9d · Note