CVE-2014-4892

The uControl Smart Home Automation aka de.ucontrol application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4892

The CVE-2014-4892 entry affects the uControl Smart Home Automation Android app (version 1.2). The underlying issue is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted cert...

INSTEON Hub 2242-222 - Lack of Web and API Authentication

No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-023: Lack of Web and API Authentication Vulnerability in INSTEON Hub Published: 8/01/13 Version: 1.0 Vendor: INSTEON http://www.INSTEON.com/ Product: Hub Version affected: 2242-222 model discontinued Product...

MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities

No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde http://www.micasaverde.com/ Product: VeraLite Version affected: 1.5.408 Product description: The MiCasaVerd...

CVE-2013-6949

The Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN protocols, which allows remote attackers to hijack connections and possibly have unspecified other impact by leveraging access to a single WeMo device...

CVE-2013-6950

The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server...

CVE-2013-6951

The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate...

CVE-2013-6948

The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Hardcoded credentials

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

Code injection

The Belkin WeMo Home Automation firmware before 3949 does not properly use the STUN and TURN protocols, which allows remote attackers to hijack connections and possibly have unspecified other impact by leveraging access to a single WeMo device...

Xxe

The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Design/Logic Flaw

The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server...

Code injection

The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate...

CVE-2013-6948

The Belkin Wemo WeMo API server firmware prior to 3949 is affected by an XML External Entity (XXE) vulnerability in the peerAddresses API, allowing remote attackers to read arbitrary device files via an XML document containing an external entity declaration and a reference. Impact is remote, unau...

CVE-2013-6951

The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate...

CVE-2013-6949

CVE-2013-6949 concerns Belkin Wemo Home Automation devices: the firmware before 3949 does not properly use STUN/TURN, enabling a remote attacker who controls one device to relay connections to other Wemo devices. The impact is described as hijacking connections with potential further impact; expl...

CVE-2013-6950

The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server...

CVE-2013-6952

The CVE-2013-6952 issue affects Belkin WeMo Home Automation firmware prior to 3949, which contains a hardcoded GPG key that could allow remote attackers to sign a malicious firmware update and execute arbitrary code via crafted signed data. Impact described across sources indicates potential remo...

CVE-2013-6951

The CVE-2013-6951 entry concerns Belkin Wemo Home Automation firmware prior to version 3949, which does not maintain a local set of CA public keys. This flaw enables man-in-the-middle attackers to spoof SSL servers by presenting arbitrary X.509 certificates, compromising SSL/TLS integrity for aff...

CVE-2013-6950

CVE-2013-6950 affects Belkin Wemo Home Automation firmware prior to 3949, where the distribution feed did not use SSL, enabling MITM-style firmware spoofing. The issue is mitigated by Belkin’s updates (firmware 3949 and SSL-enabled distribution feed) released in 2014, plus app updates, which add ...