Serious Unpatched Vulnerability Uncovered in Popular Belkin Wemo Smart Plugs

The second generation version of Belkin's Wemo Mini Smart Plug has been found to contain a buffer overflow vulnerability that could be weaponized by a threat actor to inject arbitrary commands remotely. The issue, assigned the identifier CVE-2023-27217 , was discovered and reported to Belkin on...

The vulnerability of microprogrammed software in Nexx Garage Door Controllers (NXG-100B, NXG-200), Nexx Smart Plugs (NXPG-100W), and Nexx Smart Alarms (NXAL-100) lies in their susceptibility to being bypassed through the use of a user-controlled key. This allows intruders to alter the settings of the devices and gain access to information about them.

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability could allow an intruder to...

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), and Nexx Smart Alarm (NXAL-100) stems from insufficient validation of input data. This allows intruders to obtain information intended for other devices.

The vulnerabilities of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 are related to insufficient verification of input data. Exploiting these vulnerabilities can allow an attacker operating remotely to...

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), and Nexx Smart Alarm (NXAL-100) lies in the ability to bypass authentication by using a user-controlled key. This allows intruders to execute arbitrary commands.

The vulnerability of the microprogrammed software of the Nexx Garage Door Controller NXG-100B, NXG-200, Nexx Smart Plug NXPG-100W, and Nexx Smart Alarm NXAL-100 lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an unauthorized person...

CVE-2023-1748

CVE-2023-1748 affects Nexx Smart Home devices (Nexx Garage Door Controller NXG-100B/NXG-200, Nexx Smart Plug NXPG-100W, Nexx Smart Alarm NXAL-100). The root cause is use of hard-coded credentials, enabling an unauthenticated attacker with access to the Nexx Home mobile app or affected firmware to...

多款Nexx产品授权问题漏洞

Nexx Garage Door Controller and others are products of Nexx Corporation.Nexx Garage Door Controller is a garage door controller.Nexx Smart Plug is a smart plug.Nexx Smart Alarm is a smart alarm. A security vulnerability exists in the Nexx Smart Home Device that stems from allowing any user to...

PT-2023-2620 · Nexx · Nexx Smart Alarm +2

Name of the Vulnerable Software and Affected Versions: Nexx Garage Door Controller versions NXG-100B, NXG-200 Nexx Smart Plug version NXPG-100W Nexx Smart Alarm version NXAL-100 Description: The issue is related to a lack of proper access control when executing actions on Nexx Smart Home devices...

PT-2023-2619 · Nexx · Nexx Smart Alarm +2

Name of the Vulnerable Software and Affected Versions: Nexx Garage Door Controller versions NXG-100B, NXG-200 Nexx Smart Plug version NXPG-100W Nexx Smart Alarm version NXAL-100 Description: The issue is related to the use of hard-coded credentials in the firmware of Nexx Smart Home devices. This...

PT-2023-2623 · Nexx · Nexx Garage Door Controller +3

Name of the Vulnerable Software and Affected Versions: Nexx Smart Home devices affected versions not specified Nexx Garage Door Controller NXG-100B, NXG-200 Nexx Smart Plug NXPG-100W Nexx Smart Alarm NXAL-100 Description: The issue is related to weaknesses in the authentication procedure of Nexx...

多款Nexx产品信任管理问题漏洞

Nexx Garage Door Controller and others are products of Nexx Corporation.Nexx Garage Door Controller is a garage door controller.Nexx Smart Plug is a smart plug.Nexx Smart Alarm is a smart alarm. A security vulnerability exists in the Nexx Smart Home Device that stems from the use of hard-coded...

D-Link DSP-W215 null pointer dereference vulnerability

The D-Link DSP-W215 is a smart plug product from D-Link, a Taiwan-based company. A security vulnerability exists in the D-Link DSP-W215 1.10, which can be exploited by attackers to cause a denial of service for related devices...

‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product

ARCHIVED STORY ‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product By Douglas McKee · August 18, 2020 Eoin Carroll, Charles McFarland, Kevin McGrath, and Mark Bereza contributed to this report. The Internet of Things promises to make our lives easier. Want to remotely turn...

‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product

ARCHIVED STORY ‘Insight’ into Home Automation Reveals Vulnerability in Simple IoT Product By Douglas McKee · August 18, 2020 Eoin Carroll, Charles McFarland, Kevin McGrath, and Mark Bereza contributed to this report. The Internet of Things promises to make our lives easier. Want to remotely turn...

D-Link DSP-W215 Information Disclosure Vulnerability (CNVD-2020-33174)

The D-Link DSP-W215 is a smart plug product from Taiwan, China-based AUO D-Link. A security vulnerability exists in D-Link DSP-W215 version 1.26b03. An attacker can exploit the vulnerability to cause information disclosure...

Unspecified Vulnerability in Eques Technology elf smart plug

Eques Technology elf smart plug is a smart plug device from Eques Technology in China. A security vulnerability exists in the Eques Technology elf smart plug. An attacker could use this vulnerability to discover all smart plugs in a network, take control of the device and perform actions...

CVE-2019-15745

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart...

Hardcoded credentials

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart...

CVE-2019-15745

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart...

CVE-2019-15745

The CVE-2019-15745 entry concerns the Eques elf smart plug (and its mobile app). The vulnerability arises from a hardcoded AES-256 key used to encrypt commands/responses between the device and the app, with communication over UDP port 27431. According to the sources, an attacker on the local netw...

IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target?

ARCHIVED STORY IoT Zero-Days – Is Belkin WeMo Smart Plug the Next Malware Target? By Steve Povolny · April 18, 2019 Effective malware is typically developed with intention, targeting specific victims using either known or unknown vulnerabilities to achieve its primary functions. In this blog, we...