Lucene search

MitreCVE-2019-11334

HistoryJun 11, 2019 - 6:29 p.m.

CVE-2019-11334

2019-06-1118:29:00

CWE-294

mitre

web.nvd.nist.gov

cve-2019-11334

authentication bypass

tzumi electronics klic lock

mobile devices

capture-replay

smart padlock

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.003

Percentile

71.4%

JSON

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources (that are not otherwise accessible without proper authentication) via capture-replay. Physically proximate attackers can use this information to unlock unauthorized Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2.

Affected configurations

Nvd

Node

tzumiklic_lockMatch1.0.9

Node

tzumiklic_smart_padlock_model_5686_firmwareMatch6.2

AND

tzumiklic_smart_padlock_model_5686Match-

VendorProductVersionCPE
tzumiklic_lock1.0.9cpe:2.3:a:tzumi:klic_lock:1.0.9:*:*:*:*:*:*:*
tzumiklic_smart_padlock_model_5686_firmware6.2cpe:2.3:o:tzumi:klic_smart_padlock_model_5686_firmware:6.2:*:*:*:*:*:*:*
tzumiklic_smart_padlock_model_5686-cpe:2.3:h:tzumi:klic_smart_padlock_model_5686:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tzumi	klic_lock	1.0.9	cpe:2.3:a:tzumi:klic_lock:1.0.9:::::::*
tzumi	klic_smart_padlock_model_5686_firmware	6.2	cpe:2.3:o:tzumi:klic_smart_padlock_model_5686_firmware:6.2:::::::*
tzumi	klic_smart_padlock_model_5686	-	cpe:2.3:h:tzumi:klic_smart_padlock_model_5686:-:::::::*

References

packetstormsecurity.com/files/153280/Tzumi-Electronics-Klic-Lock-Authentication-Bypass.html

github.com/whitehatdefenses/KlicUnLock

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.003

Percentile

71.4%

JSON

Related for CVE-2019-11334