CVE-2022-24188 in App
Summary
by MITRE • 11/29/2022
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified in CVE-2022-24188 represents a critical security flaw within the Ourphoto App version 1.4.1 that directly impacts the confidentiality and integrity of user authentication credentials. This vulnerability exists within the device sign-in endpoint which is designed to facilitate communication between picture frame devices and user accounts. The exposed clear-text passwords include both deviceVideoCallPassword and mqttPassword, which are essential for video calling functionality and device communication protocols. The flaw stems from inadequate input validation and insufficient authentication mechanisms that fail to properly protect sensitive credential information during transmission and storage processes.
The technical implementation of this vulnerability demonstrates a fundamental failure in secure credential handling practices, specifically aligning with CWE-522 which addresses insufficiently protected credentials. The absence of proper session management creates a pathway for unauthorized access to multiple user accounts through a single compromised endpoint. This weakness enables what is known as insecure direct object references, where the application provides direct access to objects without proper authorization checks. Attackers can exploit this vulnerability to enumerate and retrieve password information for other end-users devices, effectively bypassing normal access controls and authentication mechanisms. The impact is particularly severe given that many picture frame devices support video calling capabilities, making the stolen credentials potentially usable for unauthorized video communication sessions.
The operational impact of this vulnerability extends beyond simple credential theft to encompass potential unauthorized access to personal video communication systems. This exposure creates opportunities for man-in-the-middle attacks, where malicious actors can intercept and utilize the clear-text passwords to gain control over connected devices. The vulnerability affects the device's ability to maintain secure communication channels and undermines the trust model between users and their picture frame devices. Organizations and individuals relying on these devices for personal or commercial use face significant risks including privacy violations, unauthorized surveillance, and potential exploitation of video calling features for malicious purposes.
Security mitigations for this vulnerability must address both immediate remediation and long-term architectural improvements to prevent similar issues. The primary solution involves implementing proper encryption for all sensitive credential information, ensuring that passwords are never transmitted or stored in clear-text formats. Session management mechanisms should be strengthened to include proper authentication tokens and access control checks that prevent unauthorized enumeration of user resources. The implementation of secure direct object reference controls is essential to ensure that users can only access their own device resources. Additionally, organizations should implement comprehensive logging and monitoring to detect unauthorized access attempts and credential exposure events. This vulnerability highlights the importance of following secure coding practices and implementing defense-in-depth strategies that protect sensitive information throughout the entire application lifecycle. The remediation efforts should align with industry standards such as those outlined in the OWASP Top Ten and NIST cybersecurity frameworks to ensure comprehensive protection against similar vulnerabilities.