CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
8.8 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, was found in Microsoft Xbox Live (Game Console) (unknown version). This affects an unknown code block of the component Password Recovery. The manipulation as part of a Space as Password leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability.
The weakness was released 04/03/2014 by Kristoffer Von Hassel as 5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability as not defined video (ABC 10 News). The advisory is shared at 10news.com. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The advisory points out:
When 5-year-old Kristoffer Von Hassel is playing his Xbox, his feet don't touch the ground. But something he did has made the smartest guys at Microsoft pay attention. (...) A suddenly excited Kristoffer showed Dad that when he typed in a wrong password for his father’s account, it clicked to a password verification screen. By typing in space keys, then hitting enter, Kristoffer was able to get in through a back door.
After immediately, there has been an exploit disclosed. It is declared as proof-of-concept.
The video contains the following remark:
In a statement, Microsoft said, "We're always listening to our customers and thank them for bringing issues to our attention. We take security seriously at Xbox and fixed the issue as soon as we learned about it." Kristoffer will receive four games, $50 and a year-long subscription to Xbox Live from Microsoft. He also knows what he now wants to be when he grows up: a gamer. His dad is leaning toward something in computer security.
Further details are available at 10news.com.
Product
Type
Vendor
Name
License
Screenshot
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 9.8VulDB Meta Temp Score: 8.8
VulDB Base Score: 9.8
VulDB Temp Score: 8.8
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Improper authenticationCWE: CWE-287
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Proof-of-Concept
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Exploit Delay Time: 🔍
Timeline
04/03/2014 🔍04/03/2014 🔍
04/04/2014 🔍
04/01/2019 🔍
Sources
Vendor: microsoft.comAdvisory: 5-year-old Ocean Beach boy exposes Microsoft Xbox vulnerability
Researcher: Kristoffer Von Hassel
Status: Not defined
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
Entry
Created: 04/04/2014 17:20Updated: 04/01/2019 11:03
Changes: 04/04/2014 17:20 (46), 04/01/2019 11:03 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.