Lucene search

Japan Vulnerability NotesJVN:48687031

HistoryMay 18, 2023 - 12:00 a.m.

JVN#48687031: Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay

2023-05-1800:00:00

Japan Vulnerability Notes

jvn.jp

qrio smart lock

authentication bypass

capture-replay

firmware update

product security

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

25.8%

JSON

Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability (CWE-294).

Impact

An attacker may analyze the product’s communication data and perform unintended operations under certain conditions.

Solution

Update the firmware and related products
Update the firmware and related products to the latest version according to the information provided by the developer.

Products Affected

Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

25.8%

JSON

Related for JVN:48687031