CVEvulnerability
CVE-2018-16225
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-09-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 6.1 MEDIUM — AV:A/AC:L/Au:N/C:N/I:N/A:C
- Weaknesses
- CWE-319
Description
The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.
Affected configurations
• qbeecam qbee multi-sensor camera firmware (<= 4.16.4)
• qbeecam qbeecam (<= 1.0.5)
• swisscom swisscom home app (<= 10.7.2)
Related
Weakness · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
References
- https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability/ Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2018/Sep/21 Mailing List, Third Party Advisory
- https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability/ Exploit, Third Party Advisory
- https://seclists.org/fulldisclosure/2018/Sep/21 Mailing List, Third Party Advisory