CVE-2024-0390 Hard-coded credentials in iZZi connect application
Hard-coded MQTT credentials in the iZZi connect Android app allow attackers to access and modify recuperation device parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0390?
CVE-2024-0390 is a medium-severity vulnerability in INPRAX iZZi connect, published on 15 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.
Weakness: CWE-798
Which versions are affected by CVE-2024-0390?
It affects 1 product.
Products include Inprax Izzi Connect.
How do I fix CVE-2024-0390?
No fix has been published for CVE-2024-0390 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0390 being exploited?
There is no known exploitation of CVE-2024-0390 in the wild and no public exploit code.
Sources
Also known as GHSA-78p5-2vmq-27q9.