Details of VAR-201402-0134

ID

VAR-201402-0134

CVE

CVE-2013-6950

TITLE

Belkin Wemo Home Automation devices contain multiple vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#656302

DESCRIPTION

The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed, which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server. Belkin Wemo Home Automation devices contain multiple vulnerabilities. Supplementary information : CWE Vulnerability type by CWE-319: Cleartext Transmission of Sensitive Information ( Clear text transfer of confidential information ) Has been identified. http://cwe.mitre.org/data/definitions/319.htmlIf a third party intercepts the network, important information may be obtained. An attacker can exploit this issue to perform man-in-the-middle attacks and disclose sensitive information. Successful exploits may lead to other attacks

Trust: 3.24

sources: NVD: CVE-2013-6950 // CERT/CC: VU#656302 // JVNDB: JVNDB-2013-006070 // CNVD: CNVD-2014-01085 // BID: 65631 // VULHUB: VHN-66952

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-01085

AFFECTED PRODUCTS

vendor:	belkin	model:	wemo home automation	scope:	eq	version:	2769	Trust: 1.6
vendor:	belkin	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	belkin	model:	wemo home automation	scope:	lt	version:	3949	Trust: 0.8
vendor:	belkin	model:	international,inc home automation devices	scope:	-	version:	-	Trust: 0.6

sources: CERT/CC: VU#656302 // CNVD: CNVD-2014-01085 // JVNDB: JVNDB-2013-006070 // CNNVD: CNNVD-201402-311 // NVD: CVE-2013-6950

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-6950
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-6950
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2014-01085
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201402-311
value:	HIGH
Trust: 0.6
VULHUB:	VHN-66952
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-6950
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2014-01085
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-66952
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2014-01085 // VULHUB: VHN-66952 // JVNDB: JVNDB-2013-006070 // CNNVD: CNNVD-201402-311 // NVD: CVE-2013-6950

PROBLEMTYPE DATA

problemtype:	CWE-310	Trust: 1.9
problemtype:	CWE-Other	Trust: 0.8

sources: VULHUB: VHN-66952 // JVNDB: JVNDB-2013-006070 // NVD: CVE-2013-6950

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201402-311

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201402-311

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-006070

PATCH

title:

WeMo Home Automation

url:

http://www.belkin.com/us/Products/home-automation/c/wemo-home-automation/

Trust: 0.8

sources: JVNDB: JVNDB-2013-006070

EXTERNAL IDS

db:	CERT/CC	id:	VU#656302	Trust: 3.9
db:	NVD	id:	CVE-2013-6950	Trust: 3.4
db:	BID	id:	65631	Trust: 1.0
db:	JVN	id:	JVNVU97009803	Trust: 0.8
db:	JVNDB	id:	JVNDB-2013-006070	Trust: 0.8
db:	CNNVD	id:	CNNVD-201402-311	Trust: 0.7
db:	CNVD	id:	CNVD-2014-01085	Trust: 0.6
db:	VULHUB	id:	VHN-66952	Trust: 0.1

sources: CERT/CC: VU#656302 // CNVD: CNVD-2014-01085 // VULHUB: VHN-66952 // BID: 65631 // JVNDB: JVNDB-2013-006070 // CNNVD: CNNVD-201402-311 // NVD: CVE-2013-6950

REFERENCES

url:	http://www.ioactive.com/pdfs/ioactive_belkin-advisory-lite.pdf	Trust: 3.3
url:	http://www.kb.cert.org/vuls/id/656302	Trust: 2.3
url:	http://cwe.mitre.org/data/definitions/611.html	Trust: 0.8
url:	http://cwe.mitre.org/data/definitions/321.html	Trust: 0.8
url:	http://cwe.mitre.org/data/definitions/494.html	Trust: 0.8
url:	http://cwe.mitre.org/data/definitions/441.html	Trust: 0.8
url:	http://cwe.mitre.org/data/definitions/319.html	Trust: 0.8
url:	http://www.belkin.com/us/products/home-automation/c/wemo-home-automation	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6950	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu97009803/	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6950	Trust: 0.8
url:	http://www.kb.cert.org/vuls/id/656302\	Trust: 0.8

sources: CERT/CC: VU#656302 // CNVD: CNVD-2014-01085 // VULHUB: VHN-66952 // JVNDB: JVNDB-2013-006070 // CNNVD: CNNVD-201402-311 // NVD: CVE-2013-6950

CREDITS

Mike Davis of IOActive

Trust: 0.3

sources: BID: 65631

SOURCES

db:	CERT/CC	id:	VU#656302
db:	CNVD	id:	CNVD-2014-01085
db:	VULHUB	id:	VHN-66952
db:	BID	id:	65631
db:	JVNDB	id:	JVNDB-2013-006070
db:	CNNVD	id:	CNNVD-201402-311
db:	NVD	id:	CVE-2013-6950

LAST UPDATE DATE

2025-04-11T22:48:23.222000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#656302	date:	2014-07-29T00:00:00
db:	CNVD	id:	CNVD-2014-01085	date:	2014-02-20T00:00:00
db:	VULHUB	id:	VHN-66952	date:	2014-03-06T00:00:00
db:	BID	id:	65631	date:	2014-02-18T00:00:00
db:	JVNDB	id:	JVNDB-2013-006070	date:	2014-02-25T00:00:00
db:	CNNVD	id:	CNNVD-201402-311	date:	2014-02-25T00:00:00
db:	NVD	id:	CVE-2013-6950	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#656302	date:	2014-02-18T00:00:00
db:	CNVD	id:	CNVD-2014-01085	date:	2014-02-20T00:00:00
db:	VULHUB	id:	VHN-66952	date:	2014-02-22T00:00:00
db:	BID	id:	65631	date:	2014-02-18T00:00:00
db:	JVNDB	id:	JVNDB-2013-006070	date:	2014-02-25T00:00:00
db:	CNNVD	id:	CNNVD-201402-311	date:	2014-02-25T00:00:00
db:	NVD	id:	CVE-2013-6950	date:	2014-02-22T21:55:09.267