CVEvulnerability
CVE-2020-12702
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-02-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.6 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-327
Description
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.
Affected configurations
• coolkit ewelink (<= 4.9.1)
• coolkit ewelink (<= 4.9.2)
Related
Weakness · CWE (1)
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
References
- https://dl.acm.org/doi/abs/10.1145/3411498.3419965 Third Party Advisory
- https://github.com/salgio/ESPTouchCatcher Exploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US Product, Third Party Advisory
- https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be Exploit, Third Party Advisory
- https://dl.acm.org/doi/abs/10.1145/3411498.3419965 Third Party Advisory
- https://github.com/salgio/ESPTouchCatcher Exploit, Third Party Advisory
- https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US Product, Third Party Advisory
- https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be Exploit, Third Party Advisory