CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the lock. The user ID, name, and MAC address are trivially obtained from APIs found within the Android or iOS application. With only the MAC address of the lock, any attacker can transfer ownership of the lock from the current user, over to the attacker's account. Thus rendering the lock completely inaccessible to the current user.

CVSS v3 9.8 CRITICAL
CVSS v2.0 9.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:C

Exploitability : 10.0 / Impact : 8.5

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/	Exploit Third Party Advisory
http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:shenzhen_dragon_brothers:fb50_firmware:2.3:*:*:*:*:*:*:*

cpe:2.3:h:shenzhen_dragon_brothers:fb50:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:24

Type	Values Removed	Values Added
References	~~() http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/ - Exploit, Third Party Advisory~~	() http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/ - Exploit, Third Party Advisory

Information

Published : 2019-08-06 18:15

Updated : 2024-11-21 04:24

NVD link : CVE-2019-13143

Mitre link : CVE-2019-13143

CVE.ORG link : CVE-2019-13143

JSON object : View

Products Affected

shenzhen_dragon_brothers

fb50
fb50_firmware

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-13143", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-08-06T18:15:11.267", "references": [{"url": "http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the lock. The user ID, name, and MAC address are trivially obtained from APIs found within the Android or iOS application. With only the MAC address of the lock, any attacker can transfer ownership of the lock from the current user, over to the attacker's account. Thus rendering the lock completely inaccessible to the current user."}, {"lang": "es", "value": "Se detect\u00f3 un problema de contaminaci\u00f3n de par\u00e1metros HTTP en Brothers Fingerprint Bluetooth Round Padlock FB50 de Shenzhen versi\u00f3n 2.3. Con el ID de usuario, el nombre de usuario y la direcci\u00f3n MAC del candado, cualquiera puede desvincular al propietario existente del candado y, en su lugar, vincularse. Esto conlleva a la toma de control completa del candado. La identificaci\u00f3n de usuario, el nombre y la direcci\u00f3n MAC se obtienen trivialmente de las API que se encuentran dentro de la aplicaci\u00f3n de Android o iOS. Con solo la direcci\u00f3n MAC del candado, cualquier atacante puede transferir la propiedad del candado del usuario actual a la cuenta del atacante. De este modo, el usuario actual no puede acceder al candado."}], "lastModified": "2024-11-21T04:24:17.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:shenzhen_dragon_brothers:fb50_firmware:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F86EC9A3-303A-46B6-9F56-B90615C2579C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:shenzhen_dragon_brothers:fb50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7EA162C8-6383-47CC-9418-1D0852F7362F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}