CVE-2018-16242

Published: Sep 14, 2018Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.

Affected (2)

Products: O.bike: Smart Locker Firmware, Obike Stationless Bike Sharing

O.bike

2 products

Smart Locker Firmware

Obike Stationless Bike Sharing

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
O.bike Smart Locker Firmware	All versions

Running on/with	Platform Versions
O.bike Smart Locker	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
O.bike Obike Stationless Bike Sharing	Version 2.5.4

Related CWEs

CWE-294

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://seclists.org/bugtraq/2018/Sep/30

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://seclists.org/bugtraq/2018/Sep/30

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

Timeline

No history available yet.