CVE-2016-5053: Missing Authentication for Critical Function

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000...

CVE-2016-5051: Exposure of Sensitive Information to an Unauthorized Actor

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

PT-2017-8681

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue allows attackers to obtain sensitive information by reading screenshots under the /private/var/mobile/Containers/Data/Application directory. Recommendations F...

PT-2017-8680

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue allows Zigbee replay. Recommendations For OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26, update to a version released after 2016-07-26 to...

PT-2017-8673

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home versions prior to 2016-07-26 Description The issue concerns the storage of a Pre-Shared Key PSK in cleartext. Specifically, it is stored under the /private/var/mobile/Containers/Data/Application path. This...

PT-2017-8679

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue concerns the lack of SSL pinning in the OSRAM SYLVANIA Osram Lightify Pro. This could potentially allow for man-in-the-middle attacks. Recommendations For OSR...

PT-2017-8674

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 Description The issue is related to the lack of SSL pinning in the OSRAM SYLVANIA Osram Lightify Home. This means that the device does not properly verify the identity of the server it is...

PT-2017-8675

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home versions prior to 2016-07-26 Description The issue allows remote attackers to execute arbitrary commands. This can be done via TCP port 4000. Recommendations For OSRAM SYLVANIA Osram Lightify Home versions...

PT-2017-8678

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue concerns the use of a Pre-Shared Key PSK that is only 8 hex digits long, which may be insufficient for secure authentication. Recommendations For OSRAM SYLVAN...

Unpatched Smart Lighting Flaws Pose IoT Risk to Businesses

A host of web-based vulnerabilities in Osram Lightify smart lighting products remain unpatched, despite private notification to the vendor in late May and CVEs assigned to the issues in June by CERT/CC. Researchers at Rapid7 today publicly disclosed some of the details on each of the nine...