Lucene search

MitreCVE-2018-11315

HistoryMay 20, 2018 - 1:29 p.m.

CVE-2018-11315

2018-05-2013:29:00

CWE-20

mitre

web.nvd.nist.gov

cve-2018-11315

radio thermostat

ct50

ct80

http api

unauthorized access

dns rebinding attack

vulnerability

nvd

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0.006

Percentile

78.5%

JSON

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home’s target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860.

Affected configurations

Nvd

Node

radiothermostatct50_firmwareRange≤1.04.84

AND

radiothermostatct50Match-

Node

radiothermostatct80_firmwareRange≤1.04.84

AND

radiothermostatct80Match-

VendorProductVersionCPE
radiothermostatct50_firmware*cpe:2.3:o:radiothermostat:ct50_firmware:*:*:*:*:*:*:*:*
radiothermostatct50-cpe:2.3:h:radiothermostat:ct50:-:*:*:*:*:*:*:*
radiothermostatct80_firmware*cpe:2.3:o:radiothermostat:ct80_firmware:*:*:*:*:*:*:*:*
radiothermostatct80-cpe:2.3:h:radiothermostat:ct80:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
radiothermostat	ct50_firmware	*	cpe:2.3:o:radiothermostat:ct50_firmware::::::::
radiothermostat	ct50	-	cpe:2.3:h:radiothermostat:ct50:-:::::::*
radiothermostat	ct80_firmware	*	cpe:2.3:o:radiothermostat:ct80_firmware::::::::
radiothermostat	ct80	-	cpe:2.3:h:radiothermostat:ct80:-:::::::*

References

github.com/brannondorsey/radio-thermostat

medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325

www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability

CVSS2

3.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0.006

Percentile

78.5%

JSON

Related for CVE-2018-11315