CVE-2021-27941

2021-05-0620:31:53

mitre

www.cve.org

ewelink

encryption key

qr code

pairing

wi-fi eavesdropping

mobile application

android

ios

sensitive information

AI Score

Confidence

High

EPSS

0.001

Percentile

29.7%

JSON

Unconstrained Web access to the device’s private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and through 4.9.1 on iOS) allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during a device pairing process.