Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for miniserver_gen_1_firmware by loxone

    CVE-2020-27488 (GCVE-0-2020-27488)

    Vulnerability from nvd – Published: 2021-01-13 19:06 – Updated: 2024-08-04 16:18
    VLAI
    Summary
    Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:18:44.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.loxone.com/enen/security-cloud-dns/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the \"signature of the update package.\" Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device\u0027s firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-13T19:06:54.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.loxone.com/enen/security-cloud-dns/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-27488",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the \"signature of the update package.\" Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device\u0027s firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/",
              "refsource": "MISC",
              "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
            },
            {
              "name": "https://www.loxone.com/dede/sicherheit-cloud-dns/",
              "refsource": "MISC",
              "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
            },
            {
              "name": "https://www.loxone.com/enen/security-cloud-dns/",
              "refsource": "MISC",
              "url": "https://www.loxone.com/enen/security-cloud-dns/"
            },
            {
              "name": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/",
              "refsource": "MISC",
              "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-27488",
    "datePublished": "2021-01-13T19:06:54.000Z",
    "dateReserved": "2020-10-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:18:44.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-27488 (GCVE-0-2020-27488)

    Vulnerability from cvelistv5 – Published: 2021-01-13 19:06 – Updated: 2024-08-04 16:18
    VLAI
    Summary
    Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:18:44.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.loxone.com/enen/security-cloud-dns/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the \"signature of the update package.\" Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device\u0027s firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-13T19:06:54.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.loxone.com/enen/security-cloud-dns/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-27488",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the \"signature of the update package.\" Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device\u0027s firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/",
              "refsource": "MISC",
              "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_schwachstelle/"
            },
            {
              "name": "https://www.loxone.com/dede/sicherheit-cloud-dns/",
              "refsource": "MISC",
              "url": "https://www.loxone.com/dede/sicherheit-cloud-dns/"
            },
            {
              "name": "https://www.loxone.com/enen/security-cloud-dns/",
              "refsource": "MISC",
              "url": "https://www.loxone.com/enen/security-cloud-dns/"
            },
            {
              "name": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/",
              "refsource": "MISC",
              "url": "https://iot-lab-fh-ooe.github.io/loxone_clouddns_vulnerability/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-27488",
    "datePublished": "2021-01-13T19:06:54.000Z",
    "dateReserved": "2020-10-21T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:18:44.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}