Hardware vulnerability in Wamma smart door locks

Guangzhou Huama Building Materials Co., Ltd. is a modernized professional manufacturer integrating scientific research, production and sales. There is a hardware vulnerability in the Huama smart door lock, which is due to the fact that the Huama door lock radio signal is not set up with anti-repl...

CVE-2017-17704

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode...

CVE-2017-17704

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode...

Design/Logic Flaw

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode...

CVE-2017-17704

The CVE-2017-17704 entry concerns Software House iStar Ultra devices (up to 6.5.2.20569) used with the IP-ACM Ethernet Door Module. The vulnerability arises from CBC-mode encryption that reuses a fixed IV and key across messages, with no strong authentication of messages. This enables replay of w...

CVE-2017-17704

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode...

CVE-2017-13903

An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Wat...

CVE-2017-13903

An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Wat...

Vulnerability Found in Two Keyless Entry Locks

Researchers at Dell Secureworks are warning a vulnerability in two keyless entry products could allow local attackers to lock and unlock doors and create illegitimate RFID badges by sending unauthenticated requests to affected devices. Impacted are two AMAG Technology Symmetry IP-based access doo...

AMAG Symmetry Door Edge Network Controllers Command Execution Vulnerability

AMAG Symmetry Door Edge Network Controllers is a symmetry edge access control product from AMAG Technologies, Inc. in the United States. A security vulnerability exists in AMAG Symmetry Door Edge Network Controllers that stems from improper access control. The vulnerability can be exploited by a...

CVE-2017-16241

Incorrect access control in AMAG Symmetry Door Edge Network Controllers EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00 enables remote attackers to execute door controller commands e.g., lock, unlock, add ID card value by sending...

CVE-2017-16241

Incorrect access control in AMAG Symmetry Door Edge Network Controllers EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00 enables remote attackers to execute door controller commands e.g., lock, unlock, add ID card value by sending...

Command injection

Incorrect access control in AMAG Symmetry Door Edge Network Controllers EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00 enables remote attackers to execute door controller commands e.g., lock, unlock, add ID card value by sending...

CVE-2017-16241

The CVE affects AMAG Symmetry EN-1DBC/EN-2DBC door controllers. Root cause is improper access control allowing unauthenticated, network-based requests (via Serial over TCP/IP) to execute door commands (lock/unlock) and inject RFID values. Impact is remote control of doors and credential manipulat...

CVE-2017-16241

Incorrect access control in AMAG Symmetry Door Edge Network Controllers EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00 enables remote attackers to execute door controller commands e.g., lock, unlock, add ID card value by sending...

Apple Fixes Flaw Impacting HomeKit Devices

Apple said it has fixed an undisclosed vulnerability in its HomeKit framework that could have allowed unauthorized remote control of HomeKit devices such as smart locks and connected garage door openers. The flaw was first reported by the publication 9to5Mac on Thursday. According to the...

Vulnerability in Amazon Key

Amazon Key is an IoT door lock that can enable one-time access codes for delivery people. To further secure that system, Amazon sells Cloud Cam, a camera that watches the door to ensure that delivery people don't abuse their one-time access privilege. Cloud Cam has been hacked: But now security...

Amazon Promises Fix to Stop Key Service Hack

Researchers at Rhino Security Labs identified a flaw in Amazon’s Key delivery service and Cloud Cam security camera that allows a rogue courier to tamper with the camera and knock it offline, making it appear no one is entering home, when that’s not the case. Amazon Key service allows homeowners ...

HDW Player,4.0.0, RCE

HDW Player,4.0.0 and all other versions, remote code execution Note that this vulnerabilitiy was supposedly fixed by the developer in version 3.2.2, the fact that this issue has arisen again suggests that the developer is aware of it and has created a deliberate back door. The VEL believe that th...

CNNVD on the United States Netsarang company multi software the presence of malicious code briefings-vulnerability warning-the black bar safety net

Recently, the national information security vulnerabilities library CNNVD received about the the United States Netsarang company more software there malicious code in case the message send. The company Xshell And Xmanager remote connection use of the product nssock2.dll module in the presence of...