CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

CVE-2022-24190

The CVE-2022-24190 entry concerns Ourphoto App version 1.4.1. The /device/acceptBind endpoint does not require authentication or authorization, and the user_token header is not implemented on this endpoint. This allows an attacker to bind their account to another user’s picture frame and then POS...