CVE-2021-3774 Meross MSS550X Missing Encryption of Sensitive Data
An attacker can intercept plain HTTP requests during initial setup to steal Wi-Fi credentials from the Meross Smart Wi-Fi Wall Switch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-3774?
CVE-2021-3774 is a high-severity vulnerability in Meross Smart Wi-Fi 2 Way Wall Switch, published on 5 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup. This could allow a remote attacker to obtain the Wi-Fi SSID as well as the password configured by the user from Meross app via Http/JSON plain request.
Weakness: CWE-319
Which versions are affected by CVE-2021-3774?
It affects 1 product.
Products include Meross Mss550x Firmware.
How do I fix CVE-2021-3774?
No fix has been published for CVE-2021-3774 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-3774 being exploited?
There is no known exploitation of CVE-2021-3774 in the wild and no public exploit code.
Sources
Also known as GHSA-p792-3c6f-m4p5.