CVE-2018-15480
Description
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated user to reconfigure the server URL for a device registered to their account. In combination with an insecure device registration vulnerability, this allowed an attacker to reconfigure a maliciously registered device to their own rogue replica of the myStrom API and issue commands to the device, including firmware update commands.
How to fix
- mystrom wifi_switch_firmware2.66, 3.80 or later
- mystrom wifi_button_plus_firmware2.73 or later
- mystrom wifi_button_firmware2.73 or later
- mystrom wifi_switch_eu_firmware3.80 or later
- mystrom wifi_bulb_firmware2.58 or later
- mystrom wifi_led_strip_firmware3.80 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mystrom wifi_switch_firmware | v < 2.66, v < 3.80 | 2.66, 3.80 |
| mystrom wifi_button_plus_firmware | v < 2.73 | 2.73 |
| mystrom wifi_button_firmware | v < 2.73 | 2.73 |
| mystrom wifi_switch_eu_firmware | v < 3.80 | 3.80 |
| mystrom wifi_bulb_firmware | v < 2.58 | 2.58 |
| mystrom wifi_led_strip_firmware | v < 3.80 | 3.80 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.