CVE-2017-7729
HighSummary
On iSmartAlarm cube devices, there is incorrect access control because a 'new key' is transmitted in cleartext.
Risk Assessment
An attacker could intercept the transmitted key, potentially leading to unauthorized access to devices and systems.
Recommendation
It is recommended to implement encryption for transmitted keys to secure communication between devices.
Other vulnerabilities in iSmartAlarm cube devices
See all- CVE-2017-7730High
iSmartAlarm cube devices are vulnerable to Denial of Service attacks. Sending a SYN flood on port 12345 causes the 'cube' to freeze and stop responding.
- CVE-2017-7726High
iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
- CVE-2017-7728Critical
On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.
Original NVD description (English source)
On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.