CVE Vulnerability

CVE-2022-24188

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html Exploit Technical Description
Configurations

Configuration 1

cpe:2.3:a:sz-fujia:ourphoto:1.4.1:*:*:*:*:*:*:*
Information

Published : 2022-11-28 10:15

Updated : 2022-12-01 11:20

NVD link : CVE-2022-24188

Mitre link : CVE-2022-24188

Products Affected
No products.
CWE
CWE-312

Cleartext Storage of Sensitive Information