VulnerabilityModified

CVE-2022-37193

Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control.

HIGH 7.4EPSS 0.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-522
Affected: chipolo/chipolo
Source: cve@mitre.org

References

https://chipolo.net/en-us/products/chipolo-one-4-packProduct
https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.mdThird Party Advisory
https://chipolo.net/en-us/products/chipolo-one-4-packProduct
https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.mdThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.