CVE-2019-15069

An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege...

Authentication flaw

An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege...

Improper access control

A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication...

Authentication flaw

An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page...

CVE-2019-15067 An authentication bypass vulnerability discovered in Smart Battery A2-25DE

An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page...

CVE-2019-15069 An unsafe authentication interface was discovered in Smart Battery A4

An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege...

CVE-2019-15069

CVE-2019-15069 affects Smart Battery A4 via an unsafe authentication interface in firmware versions up to r1.7.9. An attacker can bypass authentication and obtain web page management privileges without modifying device files. The CVE is corroborated by multiple sources in the connected set (NVD e...

CVE-2019-15067

CVE-2019-15067 affects Smart Battery A2-25DE (a multifunctional portable charger). The issue is an authentication bypass allowing an attacker to bypass login by modifying the login page, enabling privilege gain without user interaction. CVSS v3.1: Network attack, no authentication, PRN, UI-N, wit...

CVE-2019-15068 A broken access control vulnerability discovered in Smart Battery A4

A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?= r1.7.9 allows an attacker to get/reset administrator’s password without any authentication...

CVE-2019-15068

CVE-2019-15068 concerns the Smart Battery A4 portable charger. Connected sources confirm a broken access control flaw affecting firmware versions up to and including r1.7.9, enabling an attacker to obtain or reset the administrator password without authentication. The vulnerability is described a...

Drilling open a smart door lock in 4 seconds

The BBC asked us to have a look at some smart locks for a TV show recently. We didn’t have much prep time, but were genuinely shocked by just how easy this one was to compromise. Usually, we spend time looking at Bluetooth/RF, the mobile app, the API and then move on to hardware. This time we...

This Week in Security News: Magecart Attacks and Is Your Smart TV Spying on You?

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Magecart attacks and the security implications of PSD2. Also, read about how your smart TV might be leaking your data to the lik...

Smart TVs, Subscription Services Leak Data to Facebook, Google

Smart TVs and so-called “over the top” OTT platforms are the latest IoT devices found “spying” on users and leaking sensitive data to companies such as Facebook, Amazon, Google and Netflix, according to two separate studies conducted by university researchers as well as independent research done ...

Threat landscape for smart buildings

The Kaspersky Industrial Cybersecurity Conference 2019 takes place this week in Sochi, the seventh such conference dedicated to the problems of industrial cybersecurity. Among other things, the conference will address the security of automation systems in buildings — industrial versions of the no...

Emerson DeltaV Smart Switch Multiple Vulnerabilities (ICSA-18-228-01)

Binary data 720301.prm...

Emerson DeltaV Smart Switch Hardcoded Credentials (ICSA-19-190-01)

Binary data 720299.prm...

Emerson DeltaV Smart Switch DoS (ICSA-19-010-01)

Binary data 720300.prm...

CVE-2019-13542

3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition...

CVE-2019-13538

CVE-2019-13538 affects 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager (all versions before 3.5.16.0). The vulnerability is an improper handling of active library content (CWE-79, cross-site scripting) that can cause manipulated library content to be displayed or executed. Connected s...

CVE-2019-13542

CVE-2019-13542 affects 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server (versions 3.5.11.0 to 3.5.15.0). The vulnerability is a NULL pointer dereference triggered by crafted requests from a trusted OPC UA client, potentially causing a denial-of-service condition. Public sources (CISA ICS...