CVE-2023-50129

Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter...

CVE-2023-50124

Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner...

CVE-2023-50124

Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner...

CVE-2023-50124

CVE-2023-50124 affects Flient Smart Door Lock v1.0. The vulnerability arises from default credentials present on a debug interface, combined with certain design choices, enabling an attacker to unlock the device by replacing the fingerprint stored on the scanner. The issue is described consistent...

CVE-2023-50129

The CVE-2023-50129 issue affects the Flient Smart Door Lock v1.0 where NFC tags lack encryption, enabling an attacker in close proximity to clone a tag and gain perimeter access. CVSS v3.1 vectors indicate Adjacent attack vector, Low attack complexity, No privileges required, with Confidentiality...

CVE-2023-50129

Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter...

CVE-2023-50124

Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner...

CVE-2023-50124

Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design choices, an attacker can unlock the Flient Smart Door Lock by replacing the fingerprint that is stored on the scanner...

CVE-2023-50129

Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags, which results in an attacker gaining access to the perimeter...

Cockpit door lock auto-unlock is no surprise

TL;DR Through reverse engineering a cockpit door lock controller several years ago, we’ve known about the auto-unlatch issue We couldn’t publish owing to the risk to flight safety, even though some airplane type manuals already described the behaviour in a depressurisation event Now that the Alas...

CVE-2023-5881

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5880

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

Code injection

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...

Design/Logic Flaw

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881

CVE-2023-5881 affects the Genie Aladdin Connect retrofit kit (ALDCM) by allowing unauthenticated access to the device web server’s Garage Door Control Module Setup page, enabling modification of the garage door’s Wi‑Fi SSID settings. The vulnerability is reachable over the local network (TCP port...

CVE-2023-5881 Unauthenticated access permitted to web interface page "Garage Door Control Module Setup"

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5881 Unauthenticated access permitted to web interface page "Garage Door Control Module Setup"

Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect Retrofit-Kit Model ALDCM "Garage Door Control Module Setup" and modify the Garage door's SSID settings...

CVE-2023-5880

CVE-2023-5880 affects Genie Aladdin Connect Retrofit-Kit (Model ALDCM). When the device is in configuration mode, the web server page “Garage Door Control Module Setup” is vulnerable to cross-site scripting via a broadcast SSID name containing HTML/JavaScript, enabling injection of code into a us...

CVE-2023-5880 Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name

When the Genie Company Aladdin Connect garage door opener Retrofit-Kit Model ALDCM is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allo...