PT-2024-31882 · Iot Haat · Iot Haat Smart Plug Ih-In-16A-S

Published 2024-10-07 · Updated 2024-11-04 · CVE-2024-46040

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IoT Haat Smart Plug IH-IN-16A-S version 5.16.1

Description The issue is related to Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode allows an attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.

Recommendations For IoT Haat Smart Plug IH-IN-16A-S version 5.16.1, consider disabling the Access Point Pairing mode until a patch is available to prevent exploitation. Restrict access to the authentication token to minimize the risk of replay attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-46040

Affected Products

Iot Haat Smart Plug Ih-In-16A-S

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-46040 · Security Note
• https://github.com/Anonymous120386/Anonymous · Note
• https://twitter.com/VulmonFeeds/status/1843367839358505216 · Twitter Post
• https://iothaat.com · Note
• https://t.me/cvedetector/7248 · Telegram Post
• https://twitter.com/CVEnew/status/1843318258167853320 · Twitter Post
• https://t.me/cvenotify/97307 · Telegram Post