CVE-2019-12500

Опубликовано: 31 мая 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 3.3

EPSS Низкий

Описание

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking.

Ссылки

https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/
Exploit
Third Party Advisory
https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:mi:m365_firmware:*:*:*:*:*:*:*:*

Версия до 1.5.1 (исключая)

cpe:2.3:h:mi:m365:2019-02-12:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.0011

Низкий

6.5 Medium

CVSS3

3.3 Low

CVSS2

Дефекты

CWE-306

Связанные уязвимости

GHSA-pvqm-26fc-q6j6