Security Vulnerability in Smart Electric Outlets

A security vulnerability in Belkin's Wemo Insight "smartplugs" allows hackers to not only take over the plug, but use it as a jumping-off point to attack everything else on the network. From the Register: The bug underscores the primary risk posed by IoT devices and connected appliances. Because...

Open MQTT Servers Raise Physical Threats in Smart Homes

Tens of thousands of consumer-grade Internet of Things IoT servers have been found wide-open on the internet, allowing cybercriminals to potentially compromise homeowners’ physical security. Bad actors can gain complete access to smart-home footprints to track owners’ movements, see if smart door...

Command Execution Vulnerability in Controller Technology's Little K Smart App

Controller smart home through cutting-edge wireless technology to upgrade the home electrical equipment networking, so as to realize a variety of whole-house intelligent scene. The controller has a variety of smart sockets, designed in a compact form with a variety of functions, with a linkage...

Black Hat 2018: Voice Authentication is Broken, Researchers Say

LAS VEGAS – We live in a world increasingly dominated by voice-enabled smart digital assistants. More and more we rely on Amazon’s Alexa to tell us if we have any new messages. We ask Google Home smart speakers to remind us of calendar appointments. Some banks even allow users to use their voice ...

Schneider Electric Wiser for KNX, homeLYnk and spaceLYnk Unauthorized Access Vulnerability

Schneider Electric Wiser for KNX, homeLYnk and spaceLYnk are automation programming software for different logic controllers from Schneider Electric, France. A security vulnerability exists in Schneider Electric Wiser for KNX version 2.1.0 and earlier, homeLYnk version 2.0.1 and earlier, and...

HomeMatic Incorrect Access Control Vulnerability

Homeputer CL Studio für HomeMatic is a home automation system from Contronics. An incorrect access control vulnerability exists in HomeMatic that allows an attacker to gain full access to the system...

Multiple vulnerabilities in Loxone Smart Home

Vendor & product description: "Loxone Electronics was founded in 2009. Our focus is the development and production of control solutions for all homes. Our aim is to make home automation interesting, affordable and accessible for everyone." URL: http://www.loxone.com/enus/company/about-us.html...

Raspberry Pi: Learn How to Build Amazing IoT & Robotics Projects at Home

Do you want to make your own robot at home? But, of course, one can not spend hundreds or thousands of dollars, and definitely would not be able to join a 4-year-long engineering institute to learn how to do it? Well, we have good news for you—Try the Raspberry Pi board to create amazing projects...

CVE-2016-5054

OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay...

KNXmap - KNXnet/IP scanning and auditing tool for KNX home automation installations

A tool for scanning and auditing KNXnet/IP gateways on IP driven networks. KNXnet/IP defines Ethernet as physical communication media for KNX EN 50090, ISO/IEC 14543. KNXmap also allows to scan for devices on the KNX bus via KNXnet/IP gateways. In addition to scanning, KNXmap supports other modes...

High Precision WiFi Indoor Positioning Framework: FIND

High Precision WiFi Indoor Positioning Framework The Framework for Internal Navigation and Discovery FIND allows you to use your Android smartphone or WiFi-enabled computer laptop or Raspberry Pi or etc. to determine your position within your home or office. You can easily use this system in plac...

Honeywell International Tuxedo Touch Cross-Site Request Forgery Vulnerability

Honeywell International Tuxedo Touch is a set of automation touch controllers for businesses and homes from Honeywell International, which can control cameras, thermostats, lamps, smart locks, shades, and more via the Web or a related app. A cross-site request forgery vulnerability exists in...

Pair of Bugs Open Honeywell Home Controllers Up to Easy Hacks

The accumulation of automation and Internet-connected devices in many homes these days has led observers to coin the term smart homes. But as researchers take a closer look at the security of these devices, they’re finding that what these homes really are is naive. The latest batch vulnerabilitie...

CVE-2015-2848

Cross-site request forgery CSRF vulnerability in Honeywell Tuxedo Touch before 5.2.19.0VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Honeywell Tuxedo Touch before 5.2.19.0VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command...

CVE-2015-2848

CVE-2015-2848 is a CSRF vulnerability in Honeywell Tuxedo Touch Controller, affecting all versions before 5.2.19.0_VA. A remote attacker can hijack the authentication of legitimate users to issue home-automation commands (e.g., door unlock) via forged requests. The issue is documented across mult...

CVE-2015-2848

Cross-site request forgery CSRF vulnerability in Honeywell Tuxedo Touch before 5.2.19.0VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command...

CVE-2014-4892

The CVE-2014-4892 entry affects the uControl Smart Home Automation Android app (version 1.2). The underlying issue is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted cert...

CVE-2014-4892

The uControl Smart Home Automation aka de.ucontrol application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

INSTEON Hub 2242-222 - Lack of Web and API Authentication

No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-023: Lack of Web and API Authentication Vulnerability in INSTEON Hub Published: 8/01/13 Version: 1.0 Vendor: INSTEON http://www.INSTEON.com/ Product: Hub Version affected: 2242-222 model discontinued Product...