CVE-2016-5051
HighSummary
Osram Lightify Home before July 26, 2016, stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
Risk Assessment
Storing the PSK in cleartext exposes the system to unauthorized access and potential takeover of the device.
Recommendation
It is recommended to update the software to a version after July 26, 2016, to eliminate this vulnerability and ensure proper security for PSK keys.
Other vulnerabilities in Osram Lightify Home
See all- CVE-2016-5054High
Osram Lightify Home through July 26, 2016, allows Zigbee replay, which may lead to unauthorized access to the system.
- CVE-2016-5052High
Osram Lightify Home through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
- CVE-2016-5053Critical
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
Original NVD description (English source)
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.