CVE-2019-12820 Information disclosure in n/a
An attacker can intercept cleartext HTTP traffic to steal login credentials and gain full control of the robot vacuum cleaner.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12820?
CVE-2019-12820 is a medium-severity vulnerability in n/a, published on 19 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner.
Weakness: CWE-319
Which versions are affected by CVE-2019-12820?
It affects 1 product.
Products include Jisiwei I3 Firmware.
How do I fix CVE-2019-12820?
No fix has been published for CVE-2019-12820 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12820 being exploited?
There is no known exploitation of CVE-2019-12820 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9cvh-565q-xj94.