CVE-2020-12702
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive…
Does this matter?
Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.
Description
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.
- CVSS 3.1
- 4.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.31% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-327
- Affected
- coolkit/ewelink
- Source
- cve@mitre.org
References
- https://dl.acm.org/doi/abs/10.1145/3411498.3419965Third Party Advisory
- https://github.com/salgio/ESPTouchCatcherExploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.coolkit&hl=en_USProduct, Third Party Advisory
- https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.beExploit, Third Party Advisory
- https://dl.acm.org/doi/abs/10.1145/3411498.3419965Third Party Advisory
- https://github.com/salgio/ESPTouchCatcherExploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.coolkit&hl=en_USProduct, Third Party Advisory
- https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.beExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.