CVE-2020-22001

Published: Apr 27, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote control of the smart home solution.

Affected (1)

Products: Homeautomation Project: Homeautomation

Homeautomation Project

1 product

Homeautomation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Homeautomation Project Homeautomation	Version 3.3.2

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (6)

https://cwe.mitre.org/data/definitions/290.html

Source: cve@mitre.org

Technical Description

https://www.exploit-db.com/exploits/47807

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php

Source: cve@mitre.org

ExploitThird Party Advisory

https://cwe.mitre.org/data/definitions/290.html

Source: af854a3a-2127-422b-91ae-364da2661108

Technical Description

https://www.exploit-db.com/exploits/47807

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.