CVE-2020-11922

 

Published at: - 02-04-2021 06:15

Last modified: - 10-07-2022 11:15

Total changes: - 3

Description

An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/
• https://cwe.mitre.org/data/definitions/201.html

 

Keywords

NVD

 

CVE-2020-11922

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures