CVE-2019-12821
CVSS V2 Medium 5.8
CVSS V3 Medium 4.8
Description
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.
Overview
- CVE ID
- CVE-2019-12821
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2019-07-19T18:15:11
- Last Modified Date
- 2020-08-24T17:37:01
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:jisiwei:i3_firmware:2.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:h:jisiwei:i3:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:N/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 5.8
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 4.9
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Attack Vector
- NETWORK
- Attack Compatibility
- HIGH
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- NONE
- Availability Impact
- LOW
- Base Score
- 4.8
- Base Severity
- MEDIUM
- Exploitability Score
- 2.2
- Impact Score
- 2.5
References
| Reference URL | Reference Tags |
|---|---|
| https://www.kth.se/polopoly_fs/1.914058.1561621210!/Olsson_Larsson-Forsberg_vacuum.pdf | Exploit Technical Description Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2019-12821 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12821 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:34:36 | Added to TrackCVE | |||
| 2022-12-03 23:32:39 | 2019-07-19T18:15Z | 2019-07-19T18:15:11 | CVE Published Date | updated |
| 2022-12-03 23:32:39 | 2020-08-24T17:37:01 | CVE Modified Date | updated | |
| 2022-12-03 23:32:39 | Analyzed | Vulnerability Status | updated |