Design/Logic Flaw

2018-03-3122:29:00

PRIOn knowledge base

www.prio-n.com

9.7 High

AI Score

Confidence

High

0.385 Low

EPSS

Percentile

97.3%

JSON

Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors.

CPENameOperatorVersion
smart_home_firmwareeq4.15

CPE	Name	Operator	Version
	smart_home_firmware	eq	4.15

References

www.exploit-db.com/exploits/44295/