PT-2024-13386 · Meross · Meross Msh30Q

Adam Lindberg · Published 2024-01-23 · Updated 2024-01-31 · CVE-2023-46889

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Meross MSH30Q version 4.5.23

Description The issue concerns the transmission of sensitive information in cleartext during the device setup phase. When setting up the device, it creates an unprotected Wi-Fi access point and requires the user to enter their Wi-Fi network name (SSID) and password to connect to the internet. Although the Wi-Fi password is encrypted, part of the decryption algorithm is publicly available, allowing for the decryption of the password. This affects the transmission of the Wi-Fi password and name between the device and the mobile application over the Wi-Fi network.

Recommendations For Meross MSH30Q version 4.5.23, consider changing the Wi-Fi network password and SSID after the initial setup to minimize the risk of exploitation. As a temporary workaround, restrict access to the device's setup phase to trusted networks only until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-46889

Affected Products

Meross Msh30Q

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-46889 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46889 · Vendor Advisory
• https://t.me/cvenotify/68514 · Telegram Post
• https://kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219 · Note