CVE-2016-5052
HighSummary
Osram Lightify Home through July 26, 2016, does not use SSL pinning, which may lead to man-in-the-middle attacks.
Risk Assessment
The lack of SSL pinning increases the risk of data interception between the device and the server, potentially compromising user privacy.
Recommendation
It is recommended to update the software to the latest version that implements SSL pinning to secure communication.
Other vulnerabilities in Osram Lightify Home
See all- CVE-2016-5054High
Osram Lightify Home through July 26, 2016, allows Zigbee replay, which may lead to unauthorized access to the system.
- CVE-2016-5051High
Osram Lightify Home before July 26, 2016, stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
- CVE-2016-5053Critical
Osram Lightify Home before July 26, 2016, allows remote attackers to execute arbitrary commands via TCP port 4000.
Original NVD description (English source)
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.