CVE-2019-15304 : Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for

Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding.

Published 2019-08-26 13:15:11

Updated 2020-09-24 14:15:13

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of serviceInformation leak

Products affected by CVE-2019-15304

Progradegrill » Wifi Grilling Thermometer Firmware » Version: 1.00 50006
cpe:2.3:o:progradegrill:wifi_grilling_thermometer_firmware:1.00_50006:*:*:*:*:*:*:*
Matching versions
When used together with: Progradegrill » Wifi Grilling Thermometer » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-15304

EPSS FAQ

2.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15304

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
9.1	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2019-15304

CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-15304

http://seclists.org/fulldisclosure/2019/Aug/24

Full Disclosure: Hard-coded credentials on ProGrade/Lierda Grill Temperature Monitor [CVE-2019-15304]
Mailing List;Third Party Advisory
https://www.joesandbox.com/analysis/287596/0/html

Automated Malware Analysis Report for ProGrade_v1.0.3_apkpure.com.apk - Generated by Joe Sandbox
http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.00_50006-Hardcoded-Credentials.html

ProGrade/Lierda Grill Temperature 1.00_50006 Hardcoded Credentials ≈ Packet Storm
Third Party Advisory;VDB Entry
http://progradegrill.com/wifi-grilling-thermometer/

WiFi Grilling Thermometer – Prograde Grilling
Product

Jump to

Vulnerability Details : CVE-2019-15304

Products affected by CVE-2019-15304

Exploit prediction scoring system (EPSS) score for CVE-2019-15304

CVSS scores for CVE-2019-15304

CWE ids for CVE-2019-15304

References for CVE-2019-15304