CVE-2023-6913 Session Hijacking on Imou Life app
Attackers can hijack user accounts via QR code scanning in the Imou Life app, enabling phishing and unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-6913?
CVE-2023-6913 is a high-severity vulnerability in Imou Life app, published on 19 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.
Weakness: CWE-384
Which versions are affected by CVE-2023-6913?
It affects 1 product.
Products include Imoulife Imou Life.
How do I fix CVE-2023-6913?
No fix has been published for CVE-2023-6913 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6913 being exploited?
There is no known exploitation of CVE-2023-6913 in the wild and no public exploit code.
Sources
Also known as GHSA-2gwm-8mq4-p9j4.