Monolith EASY HOME Alarmanlagen-Set RFID 弱身份验证

历史差异连接jsonxmlCTI

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
5.9	$0-$5k	0.00

摘要信息

在Monolith EASY HOME Alarmanlagen-Set中曾发现一漏洞, 此漏洞被申报为棘手。受此漏洞影响的是未知功能。手动调试的不合法输入可导致弱身份验证 (RFID)。没有现成的漏洞利用。

在Monolith EASY HOME Alarmanlagen-Set中曾发现一漏洞, 此漏洞被申报为棘手。受此漏洞影响的是未知功能。手动调试的不合法输入可导致弱身份验证 (RFID)。通过 CWE 声明此问题将指向 CWE-287。此漏洞的脆弱性 2016-11-23由公示人Gerhard Klostermeier、公示人所属公司SYSS、公示人身份[SYSS-2016-107] EASY HOME Alarmanlagen-Set - Cryptographic Issues (CWE-310)、公示人类型为Mailinglist Post (Full-Disclosure)所公布。阅读公告的网址是seclists.org。供应商曾参与漏洞披露过程。

未提供技术细节。该漏洞的知名度低于平均水平，没有现成的漏洞利用。当前漏洞利用的价值为美元大约是$0-$5k 。公告指出：

SySS GmbH found out that the 125 kHz RFID technology used by the EASY HOME MAS-S01-09 wireless alarm system has no protection by means of authentication against rogue/cloned RFID tokens. The information stored on the used RFID tokens can be read easily in a very short time from distances up to 1 meter, depending on the used RFID reader. A working cloned RFID token is ready for use within a couple of seconds using freely available tools. Thus, an attacker with one-time access to the information of an RFID token of an EASY HOME MAS-S01-09 wireless alarm system is able to create a rogue RFID token that can be used to deactivate the alarm system in an unauthorized manner.

它被宣布为未定义。该漏洞至少在49日被作为非公开零日攻击。 0日漏洞的地下市场估价大致为$0-$5k。