CVE-2018-9162: Missing Authentication for Critical Function

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors...

PT-2018-18899

Name of the Vulnerable Software and Affected Versions Contec Smart Home version 4.15 Description The issue allows unauthorized access to certain PHP files, including new user.php, edit user.php, delete user.php, and user.php, without requiring authentication. This can be exploited to change the...

Contec Smart Home 4.15 - Unauthorized Password Reset Vulnerability

Exploit for hardware platform in category web applications Title : Contec smart home 4.15 Unauthorized Password Reset Shodan Dork : "content/smarthome.php" Vendor Homepage : http://contec.co.il Tested on : Google Chrome Tested version : 4.15 Date : 2018-03-14 Author : Z3ro0ne Contact :...

Contec Smart Home 4.15 - Unauthorized Password Reset

Title : Contec smart home 4.15 Unauthorized Password Reset Shodan Dork : "content/smarthome.php" Vendor Homepage : http://contec.co.il Tested on : Google Chrome Tested version : 4.15 Date : 2018-03-14 Author : Z3ro0ne Contact : [email protected] Facebook Page : https://www.facebook.com/Z3ro0...

Contec Smart Home 4.15 Insecure Direct Object Reference

Title : Contec smart home 4.15 Unauthorized Password Reset Shodan Dork : "content/smarthome.php" Vendor Homepage : http://contec.co.il Tested on : Google Chrome Tested version : 4.15 Date : 2018-03-14 Author : Z3ro0ne Contact : [email protected] Facebook Page : https://www.facebook.com/Z3ro0...

Contec Smart Home 4.15 - Unauthorized Password Reset

Contec Smart Home 4.15 - Unauthorized Password Reset Title : Contec smart home 4.15 Unauthorized Password Reset Shodan Dork : "content/smarthome.php" Vendor Homepage : http://contec.co.il Tested on : Google Chrome Tested version : 4.15 Date : 2018-03-14 Author : Z3ro0ne Contact :...

Smart home devices can be hacked within minutes through Google search

By Waqas The Internet of Things IoT devices, especially smart home devices, This is a post from HackRead.com Read the original post: Smart home devices can be hacked within minutes through Google search...

Trend Micro at MWC: Securing Our Mobile, Connected World

Time flies pretty fast in tech. When Trend Micro was founded nearly 30 years ago, mobile phones were pretty clunky, prohibitively expensive and not in the least bit “smart.” Fast forward to today and the device in your pocket has more compute power than the NASA machines that put man on the moon...

IoT hack: how to break a smart home… again

There can never be too many IoT gadgets – that's what people usually think when buying yet another connected device with advanced functionality. From our perspective, we also think there can't be too many IoT investigations. So, we have continued our experiments into checking and uncovering how...

CVE-2017-5249

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

Code injection

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5249

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5249

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

CVE-2017-5249

CVE-2017-5249 affects Wink Labs’ Wink – Smart Home Android app (version 6.1.0.19 and earlier). The root cause is insecure storage of the OAuth token used to authorize user access, potentially exposing sensitive information. The provided sources describe the vulnerability and its existence but do ...

CVE-2017-5249: Insecure Storage of Sensitive Information

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

PT-2018-8242

Name of the Vulnerable Software and Affected Versions: Wink - Smart Home Android app versions 6.1.0.19 and prior Description: The issue concerns the storage of the OAuth token used for authorizing user access. Specifically, the token is not stored in an encrypted and secure manner. Recommendation...

Living in a Smart Home

In "The House that Spied on Me," Kashmir Hill outfits her home to be as "smart" as possible and writes about the results...

Command Execution Vulnerability in CM113-Z, the Smart Home Gateway of China Mobile Communications Corporation

China Mobile Smart Home Gateway CM113-Z is a universal gateway device from China Mobile. A command execution vulnerability exists in the CM113-Z, a smart home gateway from China Mobile Communications. An attacker can exploit the vulnerability to execute arbitrary system commands on the device...

Apple Fixes Flaw Impacting HomeKit Devices

Apple said it has fixed an undisclosed vulnerability in its HomeKit framework that could have allowed unauthorized remote control of HomeKit devices such as smart locks and connected garage door openers. The flaw was first reported by the publication 9to5Mac on Thursday. According to the...

Google Home Mini Secretly Recorded Conversations Due to “Flawed Touch Panel”

By Waqas We often hear about smart home speakers eavesdropping on all This is a post from HackRead.com Read the original post: Google Home Mini Secretly Recorded Conversations Due to Flawed Touch Panel...