CVE-2019-15745 : The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to e

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.

Published 2019-08-29 13:15:11

Updated 2019-09-05 21:23:00

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-15745

Equeshome » Elf Smart Plug Firmware » Version: N/A
cpe:2.3:o:equeshome:elf_smart_plug_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Equeshome » Elf Smart Plug » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-15745

EPSS FAQ

0.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 72 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15745

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:A/AC:L/Au:N/C:P/I:N/A:N	6.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-15745

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-15745

https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-one/

Exploiting the eques elf smart plug: Part one - The poetry of (in)security
Exploit;Third Party Advisory
https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-four/

Exploiting the eques elf smart plug: Part four - The poetry of (in)security
Exploit;Third Party Advisory
https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-two/

Exploiting the eques elf smart plug: Part two - The poetry of (in)security
Exploit;Third Party Advisory
https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-three/

Exploiting the eques elf smart plug: Part three - The poetry of (in)security
Exploit;Third Party Advisory
https://github.com/iamckn/eques

GitHub - iamckn/eques: Exploit code/scripts for the eques elf smart plugs
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2019-15745

Products affected by CVE-2019-15745

Exploit prediction scoring system (EPSS) score for CVE-2019-15745

CVSS scores for CVE-2019-15745

CWE ids for CVE-2019-15745

References for CVE-2019-15745