PT-2024-13863 · Flient · Flient Smart Door Lock

Published 2024-01-11 · Updated 2024-09-03 · CVE-2023-50124

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flient Smart Door Lock version 1.0

Description The issue is related to the use of default credentials on a debug interface, combined with certain design choices, allowing an attacker to unlock the Flient Smart Door Lock by replacing the fingerprint stored on the scanner.

Recommendations For Flient Smart Door Lock version 1.0, consider changing the default credentials on the debug interface to prevent unauthorized access. As a temporary workaround, restrict access to the debug interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-50124

Affected Products

Flient Smart Door Lock

References · 7

• 🔥 https://secura.com/services/iot/consumer-products/security-concerns-in-popular-smart-home-devices · Exploit
• https://osv.dev/vulnerability/CVE-2023-50124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50124 · Security Note
• https://twitter.com/VulmonFeeds/status/1745589591585820750 · Twitter Post
• https://t.me/cvenotify/68002 · Telegram Post
• https://t.me/cvenotify/93092 · Telegram Post
• https://twitter.com/CVEnew/status/1745545642020147475 · Twitter Post