ID
VAR-202104-0017
CVE
CVE-2020-11923
TITLE
WiZ Colors A60 Vulnerability of important information in plaintext
Trust: 0.8
DESCRIPTION
An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged. WiZ Colors A60 Contains a vulnerability in the plaintext storage of important information.Information may be obtained. Applications use general logs to reflect all kind of information to the terminal. The WIZ application does also use logs, however instead of only generic information also API credentials are submitted to the android log. The information that is reflected in the logging can be used to perform authorised requests in behalf of the user and therefore controlling the lights just as the user can do using the application. In order to obtain the information access to the device logs is required. This can most easily be done via local access and also by other apps on rooted devices. ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] WiZ Connected ------------------------------------------ [Affected Product Code Base] WiZ Colors A60 - 1.14.0 ------------------------------------------ [Affected Component] Wiz Android Application 1.15.0 ------------------------------------------ [Attack Type] Physical ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Physical access or local root access on the mobile phone is required in order to exploit this issue. ------------------------------------------ [Reference] N/A ------------------------------------------ [Has vendor confirmed or acknowledged the vulnerability?] true ------------------------------------------ [Discoverer] Wouter Wessels, Willem Westerhof, Jasper Nota, Jim Blankendaal Use CVE-2020-11923
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | wizconnected | model: | wiz | scope: | eq | version: | 1.14.0 | Trust: 1.0 |
| vendor: | wiz connected lighting | model: | colors a60 | scope: | eq | version: | wiz colors a60 firmware 1.14.0 | Trust: 0.8 |
| vendor: | wiz connected lighting | model: | colors a60 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | wiz connected lighting | model: | colors a60 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-312 | Trust: 1.0 |
| problemtype: | Plaintext storage of important information (CWE-312) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.7
TYPE
other
Trust: 0.6
PATCH
| title: | Top Page | url: | https://www.wizconnected.com/en/ | Trust: 0.8 |
| title: | WiZ Connected WiZ Colors A60 Security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=146626 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-11923 | Trust: 2.7 |
| db: | JVNDB | id: | JVNDB-2020-016452 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202104-084 | Trust: 0.6 |
| db: | OTHER | id: | NONE | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-11923 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 179802 | Trust: 0.1 |
REFERENCES
| url: | https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/ | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-11923 | Trust: 1.5 |
| url: | http://seclists.org/fulldisclosure/2024/jul/14 | Trust: 1.0 |
| url: | https://cwe.mitre.org/data/definitions/312.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
CREDITS
Willem Westerhof | Secura
Trust: 0.1
SOURCES
| db: | OTHER | id: | - |
| db: | VULMON | id: | CVE-2020-11923 |
| db: | JVNDB | id: | JVNDB-2020-016452 |
| db: | PACKETSTORM | id: | 179802 |
| db: | CNNVD | id: | CNNVD-202104-084 |
| db: | NVD | id: | CVE-2020-11923 |
LAST UPDATE DATE
2025-01-30T20:29:02.868000+00:00
SOURCES UPDATE DATE
| db: | VULMON | id: | CVE-2020-11923 | date: | 2021-04-07T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-016452 | date: | 2021-12-08T02:32:00 |
| db: | CNNVD | id: | CNNVD-202104-084 | date: | 2021-04-08T00:00:00 |
| db: | NVD | id: | CVE-2020-11923 | date: | 2024-11-21T04:58:54.883 |
SOURCES RELEASE DATE
| db: | OTHER | id: | - | date: | 2024-07-26T13:11:06 |
| db: | VULMON | id: | CVE-2020-11923 | date: | 2021-04-02T00:00:00 |
| db: | JVNDB | id: | JVNDB-2020-016452 | date: | 2021-12-08T00:00:00 |
| db: | PACKETSTORM | id: | 179802 | date: | 2024-07-30T12:35:43 |
| db: | CNNVD | id: | CNNVD-202104-084 | date: | 2021-04-02T00:00:00 |
| db: | NVD | id: | CVE-2020-11923 | date: | 2021-04-02T19:15:18.553 |