CVE-2019-11892

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to exploit the vulnerability, the adversary...

CVE-2019-11893

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

CVE-2019-11892

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to exploit the vulnerability, the adversary...

CVE-2019-11896 Incorrect pviilege assignment in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC)

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

CVE-2019-11896

CVE-2019-11896 affects the Bosch Smart Home Controller (SHC) via the 3rd-party pairing mechanism prior to version 9.8.907. The root issue is an incorrect privilege assignment that can allow a restricted app to acquire default app permissions after a successful app pairing, which requires user int...

CVE-2019-11895

The CVE-2019-11895 entry concerns an improper access control vulnerability in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) prior to 9.8.905, which can lead to denial of service affecting the SHC and connected sensors/actuators. Exposure requires the attacker to have already pai...

CVE-2019-11895 Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability, the adversary needs to...

CVE-2019-11894 Improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC)

A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup...

CVE-2019-11894

CVE-2019-11894 concerns an improper access control in the backup mechanism of the Bosch Smart Home Controller (SHC) prior to version 9.8.905. An attacker could download a backup directly after a legitimate backup completes, potentially exposing sensitive data. The public documents confirm the aff...

CVE-2019-11893

The CVE-2019-11893 entry describes an incorrect privilege assignment vulnerability in the Bosch Smart Home Controller (SHC) app permission update API. Affected product: Bosch SHC prior to version 9.8.905. Vulnerable component: the app permission update API where privilege assignments can be misap...

CVE-2019-11893 Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC)

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

CVE-2019-11892 Improper access control in the JSON-RPC interface of the Bosch Smart Home Controller (SHC)

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to exploit the vulnerability, the adversary...

CVE-2019-11892

The CVE-2019-11892 issue affects the Bosch Smart Home Controller (SHC) JSON-RPC interface. Affected component: SHC’s JSON-RPC layer. Root cause: improper access control could allow reading or modification of SHC configuration and could trigger and restore backups. Exploitation requirements: an at...

CVE-2019-11891

CVE-2019-11891 affects the Bosch Smart Home Controller (SHC) prior to version 9.8.905, with an incorrect privilege assignment in the app pairing mechanism that can lead to elevated privileges. Exploitation requires physical access to the SHC. The issue is described with a high-severity impact ( c...

CVE-2019-11891 Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)

A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the adversary needs physical access to the...

Microsoft Beefs Up Wi-Fi Protection

Microsoft has begun pushing out its May 2019 Windows 10 update, which will flag Wi-Fi networks that are using the outdated and insecure Wired Equivalent Privacy WEP and Temporal Key Integrity Protocol TKIP authentication mechanisms. WEP was introduced in 1997 as part of the original 802.11 Wi-Fi...

CVE-2019-5625

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

Authentication flaw

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

CVE-2019-5625 Eaton Halo Home Android App Insecure Storage

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

Keep Your Smart Home Safe: Here’s What You Can Do Today to Secure Your Products

The Internet of Things IoT is transforming the way we live, work and play. You can find it in the fitness trackers you might be wearing to monitor step count and heart rate. Or the car you may be driving. But more than anywhere else, you’ll see IoT at home in an increasing array of gadgets: from...