PT-2024-33146 · Unknown · Cloud Smart Lock

Published 2024-10-24 · Updated 2024-10-25 · CVE-2024-48548

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Smart Lock version 2.0.1

Description The issue concerns a leaked URL in the APK file that can be used to call an API for binding physical devices. This allows attackers to construct requests to bind the app to unknown devices by finding a valid serial number through a bruteforce attack.

Recommendations For Cloud Smart Lock version 2.0.1, consider restricting access to the API endpoint that handles device binding requests until a patch is available. As a temporary workaround, avoid using the app to bind new devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-48548

Affected Products

Cloud Smart Lock

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-48548 · Security Note
• https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.seamooncloud.cloudsmartlock/com.seamooncloud.cloudsmartlock.md · Note
• https://t.me/cvenotify/99437 · Telegram Post
• https://cloudsmartlock.com/m/app.html · Note
• https://t.me/cvedetector/8806 · Telegram Post