HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote control of the smart home solution.
References
Link | Resource |
---|---|
https://cwe.mitre.org/data/definitions/290.html | Technical Description |
https://www.exploit-db.com/exploits/47807 | Exploit Third Party Advisory VDB Entry |
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php | Exploit Third Party Advisory |
Configurations
History
26 Oct 2022, 13:59
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://cwe.mitre.org/data/definitions/290.html - Technical Description |
10 Jul 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
CWE | CWE-290 |
06 May 2021, 14:25
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
References | (EXPLOIT-DB) https://www.exploit-db.com/exploits/47807 - Exploit, Third Party Advisory, VDB Entry | |
References | (MISC) https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php - Exploit, Third Party Advisory | |
CPE | cpe:2.3:a:homeautomation_project:homeautomation:3.3.2:*:*:*:*:*:*:* | |
CWE | CWE-287 |
27 Apr 2021, 18:25
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-04-27 18:15
Updated : 2023-12-10 13:55
NVD link : CVE-2020-22001
Mitre link : CVE-2020-22001
CVE.ORG link : CVE-2020-22001
JSON object : View
Products Affected
homeautomation_project
- homeautomation
CWE
CWE-290
Authentication Bypass by Spoofing