CVE-2019-12820

{"id": "CVE-2019-12820", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}]}, "published": "2019-07-19T18:15:11.807", "references": [{"url": "https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en la aplicaci\u00f3n versi\u00f3n 2.0 del limpiador de vac\u00edo robot Jisiwei i3 de Shenzhen. Las acciones ejecutadas en la aplicaci\u00f3n, tales como cambiar una contrase\u00f1a e informaci\u00f3n personal que se comunica con el servidor, utilizan HTTP sin cifrar. Como ejemplo, al iniciar sesi\u00f3n por medio de la aplicaci\u00f3n en una cuenta de Jisiwei, la petici\u00f3n de inicio de sesi\u00f3n se env\u00eda en texto sin cifrar. La vulnerabilidad se presenta tanto en la versi\u00f3n de Android como en la de iOS de la aplicaci\u00f3n. Un atacante podr\u00eda explotar esto utilizando un ataque de tipo MiTM en la red local para obtener las credenciales de inicio de sesi\u00f3n de alguien, lo que les da acceso total al limpiador de vac\u00edo robot."}], "lastModified": "2023-11-07T03:03:42.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:jisiwei:i3_firmware:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "874CEFEB-F4EA-43EE-A4C1-16313539B876"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:jisiwei:i3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "50F2641E-12F5-4B2A-9C77-5797D7D1E79D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}