CVEvulnerability

CVE-2019-12821

4.8 MEDIUM Published 2019-07-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-07-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
CWE-330

Description

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.

Affected configurations

• jisiwei i3 firmware 2.0

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References