PT-2017-8679

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue concerns the lack of SSL pinning in the OSRAM SYLVANIA Osram Lightify Pro. This could potentially allow for man-in-the-middle attacks. Recommendations For OSR...

CVE-2016-5058: Improper Access Control

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay...

CVE-2016-5052: Undefined Security Weakness

OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning...

CVE-2016-5051: Exposure of Sensitive Information to an Unauthorized Actor

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

PT-2017-8674

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 Description The issue is related to the lack of SSL pinning in the OSRAM SYLVANIA Osram Lightify Home. This means that the device does not properly verify the identity of the server it is...

CVE-2016-5057: Undefined Security Weakness

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning...

CVE-2016-5056: Inadequate Encryption Strength

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK...

PT-2017-8675

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Home versions prior to 2016-07-26 Description The issue allows remote attackers to execute arbitrary commands. This can be done via TCP port 4000. Recommendations For OSRAM SYLVANIA Osram Lightify Home versions...

PT-2017-8678

Name of the Vulnerable Software and Affected Versions OSRAM SYLVANIA Osram Lightify Pro versions prior to 2016-07-26 Description The issue concerns the use of a Pre-Shared Key PSK that is only 8 hex digits long, which may be insufficient for secure authentication. Recommendations For OSRAM SYLVAN...

Unpatched Smart Lighting Flaws Pose IoT Risk to Businesses

A host of web-based vulnerabilities in Osram Lightify smart lighting products remain unpatched, despite private notification to the vendor in late May and CVEs assigned to the issues in June by CERT/CC. Researchers at Rapid7 today publicly disclosed some of the details on each of the nine...