CVE-2015-6033

High

Published: 31/10/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Qolsys IQ Panel (also known as QOL) before version 1.5.1 does not verify the digital signatures of software updates, allowing man-in-the-middle attackers to bypass intended access restrictions via a modified update.

Risk Assessment

The lack of digital signature verification poses a risk that malicious updates could be introduced into the system, potentially leading to unauthorized access and harm to the organization.

Recommendation

It is recommended to update the Qolsys IQ Panel to version 1.5.1 or later to ensure verification of digital signatures for software updates.

Other vulnerabilities in Qolsys IQ Panel

CVE-2015-6032High
Qolsys IQ Panel (aka QOL) before version 1.5.1 has hardcoded cryptographic keys, allowing remote attackers to create digital signatures for code by leveraging knowledge of a key from a different installation.

Original NVD description (English source)

Qolsys IQ Panel (aka QOL) before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update.