by Kastro
Paper/Archive/CVE-2020-11015

CVE-2020-11015

suculent thinx-device-api — Device Authentication Vulnerability in thinx-device-api IoT Device Management Server

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.1.591 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be reviewed further. Applies to all (mostly ESP8266/ESP32) users. This has been fixed in firmware version 2.5.0.

Affected

ProductAffectedFixed inSource
thinx-device-api< 2.5.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/suculent/thinx-device-api/security/advisories/GHSA-5x54-39xq-cwvc