CVE-2023-5880

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

CVE-2023-5880

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

CVE-2023-5879

Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...

CVE-2023-5879

Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...

CVE-2023-5881

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

Code injection

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

Authentication flaw

Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...

Design/Logic Flaw

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881 Unauthenticated access permitted to web interface page "Garage Door Control Module Setup"

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881

CVE-2023-5881 affects the Genie Aladdin Connect retrofit kit (ALDCM) by allowing unauthenticated access to the device web server’s Garage Door Control Module Setup page, enabling modification of the garage door’s Wi‑Fi SSID settings. The vulnerability is reachable over the local network (TCP port...

CVE-2023-5881 Unauthenticated access permitted to web interface page "Garage Door Control Module Setup"

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5880 Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

CVE-2023-5880 Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

CVE-2023-5880

CVE-2023-5880 affects Genie Aladdin Connect Retrofit-Kit (Model ALDCM). When the device is in configuration mode, the web server page “Garage Door Control Module Setup” is vulnerable to cross-site scripting via a broadcast SSID name containing HTML/JavaScript, enabling injection of code into a us...

CVE-2023-5879 Aladdin Connect Android Application Insecure Storage

Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...

CVE-2023-5879

CVE-2023-5879: In Genie Aladdin Connect Android app (versions 5.65 Build 2075 and earlier), authentication data was stored in clear text in the app’s local storage, enabling recovery of credentials if the device is compromised. Root cause: insecure storage of sensitive data within the Android app...

Genie Aladdin Connect Retrofit Garage Door Opener: Multiple Vulnerabilities

Rapid7, Inc. Rapid7 discovered vulnerabilities in Aladdin Connect retrofit kit garage door opener and Android mobile application produced by Genie. The affected products are: Aladdin Garage door smart retrofit kit, Model ALDCM Android Mobile application ALADDIN Connect, Version 5.65 Build 2075...

Genie Aladdin Connect garage door opener Cross-site scripting vulnerability

Genie Aladdin Connect garage door opener is a garage door opener from Genie. A security vulnerability exists in the Genie Aladdin Connect garage door opener Retrofit-Kit Model ALDCM that stems from a cross-site scripting XSS vulnerability on the Garage Door Control Module Setup page...

Genie Aladdin Connect Access Control Error Vulnerability

Genie Aladdin Connect is a garage door controller from Genie. An access control error vulnerability exists in Genie Aladdin Connect Retrofit-Kit Model ALDCM that originates from allowing an unauthenticated attacker to access the SSID settings on the Garage Door Control Module Setup page...