CVE-2017-7728
CriticalSummary
On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.
Risk Assessment
This vulnerability may lead to unauthorized access to the alarm system, posing a serious threat to the safety of property and individuals.
Recommendation
It is recommended to update the firmware of iSmartAlarm cube devices and implement additional security measures to mitigate the risk.
Other vulnerabilities in iSmartAlarm cube devices
See all- CVE-2017-7730High
iSmartAlarm cube devices are vulnerable to Denial of Service attacks. Sending a SYN flood on port 12345 causes the 'cube' to freeze and stop responding.
- CVE-2017-7729High
On iSmartAlarm cube devices, there is incorrect access control because a 'new key' is transmitted in cleartext.
- CVE-2017-7726High
iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
Original NVD description (English source)
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the alarm on/off), related to incorrect cryptography.