CVE-2020-11015 Device Authentication Vulnerability in thinx-device-api IoT Device Management Server
Attackers can spoof MAC addresses to bypass device authentication and register unauthorized devices in the thinx IoT management system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-11015?
CVE-2020-11015 is a high-severity authentication bypass vulnerability in suculent thinx-device-api, published on 29 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be reviewed further. Applies to all (mostly ESP8266/ESP32) users. This has been fixed in firmware version 2.5.0.
Weakness: CWE-290
Which versions are affected by CVE-2020-11015?
It affects 1 product.
Products include Thinx-Device-Api Project Thinx-Device-Api.
How do I fix CVE-2020-11015?
No fix has been published for CVE-2020-11015 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-11015 being exploited?
There is no known exploitation of CVE-2020-11015 in the wild and no public exploit code.