CVEvulnerability

CVE-2018-15479

6.5 MEDIUM Published 2018-08-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-08-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-287

Description

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to cloud communication. This lack of device authentication allowed an attacker to impersonate any device by guessing or learning their MAC address.

Affected configurations

• mystrom wifi switch firmware (< 2.66) • mystrom wifi switch firmware (< 3.80) • mystrom wifi button plus firmware (< 2.73) • mystrom wifi button firmware (< 2.73) • mystrom wifi switch eu firmware (< 3.80) • mystrom wifi bulb firmware (< 2.58) • mystrom wifi led strip firmware (< 3.80)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References