CVE-2018-16225

Published: Sep 18, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.

Affected (3)

Products: Qbeecam: Qbee Multi Sensor Camera Firmware, Qbeecam · Swisscom: Swisscom Home App

2 products

Qbee Multi Sensor Camera Firmware

1 product

Swisscom Home App

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qbeecam Qbee Multi Sensor Camera Firmware	Up to 4.16.4

Running on/with	Platform Versions
Qbeecam Qbee Multi Sensor Camera	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Qbeecam Qbeecam	Up to 1.0.5
Swisscom Swisscom Home App	Up to 10.7.2

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (4)

https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability/

Source: cve@mitre.org

ExploitThird Party Advisory

https://seclists.org/fulldisclosure/2018/Sep/21

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://seclists.org/fulldisclosure/2018/Sep/21

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.