CVE-2019-7729

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. The Bosch Smart Home App is not affected. iOS Apps ar...

Design/Logic Flaw

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. The Bosch Smart Home App is not affected. iOS Apps ar...

CVE-2019-7729

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. The Bosch Smart Home App is not affected. iOS Apps ar...

Design/Logic Flaw

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a malicious actor could potentially succeed in executing a man-in-the-middle attack for some connections. The Bosch Smart Home App is not affected. iOS Apps are no...

CVE-2019-7729

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app could potentially succeed in retrieving video clips or still images that have been cached for clip sharing. The Bosch Smart Home App is not affected. iOS Apps ar...

CVE-2019-7728

The CVE-2019-7728 entry concerns the Bosch Smart Camera App for Android (before version 1.3.1). The root cause is improperly implemented TLS certificate checks, enabling the possibility of a man-in-the-middle attack on certain connections. Impact is described as partial confidentiality, integrity...

CVE-2019-7728

An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a malicious actor could potentially succeed in executing a man-in-the-middle attack for some connections. The Bosch Smart Home App is not affected. iOS Apps are no...

CVE-2019-7729

The CVE affects the Bosch Smart Camera App for Android prior to version 1.3.1. It arises from insecure permission settings, enabling a local attacker to retrieve video clips or still images cached for clip sharing. Impact is limited to confidentiality (partial), with no egregious integrity/availa...

A 'Smart Wall' Could Spark a New Kind of Border Crisis

A technological barrier might be preferable to a physical one, but it raises civil liberties concerns that are largely absent from the debate...

Enphase Envoy Cross-Site Scripting Vulnerability

Enphase Envoy is a smart home referrer. enphase Envoy R3.. /home URI is vulnerable to cross-site scripting, which can be exploited by attackers to inject malicious scripts or HTML code...

BBC Inside Out. Consumer advice for the ‘smart’ homeowner

We were recently asked to demonstrate security flaws in a smart home for the BBC Inside Out TV show. We’ve done this before, so what was different? This home was by far the most connected we had looked at. Typically, homes have a few smart devices; a smart thermostat, CCTV, maybe a doorbell and...

IoT Scale Flaws Enable Denial of Service, Privacy Issues

Here is an internet of things flaw that can tip the scales to a hacker’s advantage. Researchers have discovered a bevy of flaws in a consumer smart scale that could allow hackers to launch a variety of attacks, from man-in-the-middle to denial of service attacks. Checkmarx researchers reported th...

A week in security (January 28 – February 3)

Last week, we ran another in our interview with a malware hunter series, explained a FaceTime vulnerability, and took a deep dive into a new stealer. We also threw some light on a Houzz data breach, and what exactly happened between Apple and Facebook. Other cybersecurity news Kwik Fit hit by...

Schneider Electric Acti 9 Smart Test Detection (Windows SMB Login)

Detects the installed version of Schneider Electric Acti 9 Smart Test for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Security Flaws in Children's Smart Watches

A year ago, the Norwegian Consumer Council published an excellent security analysis of children's GPS-connected smart watches. The security was terrible. Not only could parents track the children, anyone else could also track the children. A recent analysis checked if anything had improved after...

Security Analysis of the LIFX Smart Light Bulb

The security is terrible: In a very short limited amount of time, three vulnerabilities have been discovered: Wifi credentials of the user have been recovered stored in plaintext into the flash memory. No security settings. The device is completely open no secure boot, no debug interface disabled...

2019 and Beyond: The (Expanded) RSAC Advisory Board Weighs in on What’s Next: Pt. 2

Our first 2019 predictions post from the RSA Conference Advisory Board was not all sunshine and roses — cautious optimism was tabled by the acknowledged distance we must still travel as an industry — and our second set of predictions does not belie that theme. This trepidation does not mean we’re...

CVE-2018-10612

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials...

CVE-2018-10612

CVE-2018-10612 affects 3S-Smart Software Solutions GmbH CODESYS Control V3 products containing CmpSecureChannel or CmpUserMgr prior to version 3.5.14.0. Root cause: user access management and online communication encryption are not enabled by default, creating Improper Access Control and allowing...

Smart VPN 1.1.3.0 - Denial of Service Exploit

Exploit Title: Smart VPN 1.1.3.0 - Denial of Service PoC Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://www.microsoft.com/store/productId/9NH1G93D4HKR Version: 1.1.3.0 Tested on: Windows 10 Proof of Concept: Run the python script, it will create a new file "PoC.txt" Co...