Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.
References
| Link | Resource |
|---|---|
| https://dl.acm.org/doi/abs/10.1145/3411498.3419965 | Third Party Advisory |
| https://github.com/salgio/ESPTouchCatcher | Exploit Third Party Advisory |
| https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US | Product Third Party Advisory |
| https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be | Exploit Third Party Advisory |
| https://dl.acm.org/doi/abs/10.1145/3411498.3419965 | Third Party Advisory |
| https://github.com/salgio/ESPTouchCatcher | Exploit Third Party Advisory |
| https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US | Product Third Party Advisory |
| https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://dl.acm.org/doi/abs/10.1145/3411498.3419965 - Third Party Advisory | |
| References | () https://github.com/salgio/ESPTouchCatcher - Exploit, Third Party Advisory | |
| References | () https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US - Product, Third Party Advisory | |
| References | () https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be - Exploit, Third Party Advisory |
Information
Published : 2021-02-24 14:15
Updated : 2024-11-21 05:00
NVD link : CVE-2020-12702
Mitre link : CVE-2020-12702
CVE.ORG link : CVE-2020-12702
JSON object : View
Products Affected
coolkit
- ewelink
CWE
CWE-327
Use of a Broken or Risky Cryptographic Algorithm