CVE-2024-2104: Missing Authentication for Critical Function

Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable...

EUVD-2023-51080

Malicious code in bioql PyPI...

CVE-2024-20889

Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices...

CVE-2024-3077

An malicious BLE device can crash BLE victim device by sending malformed gatt packet...

A Secure “Smart” Kettle?

We haven’t looked at smart kettles for a long time, mostly as the UK market leader, Smarter, fixed their security with the iKettle 3.0. So I got quite excited when a colleague pointed out the Xiaomi ‘smart’ kettle a few weeks back. It’s the first kettle with a mobile app that we’ve seen for a...