CVE-2020-27488
Critical
Description
Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLoxone Miniserver Gen 1 Firmware
PublishedJan 13, 2021
First seenJan 13, 2021
How to fix
Update
- loxone miniserver_gen_1_firmware11.1.9.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| loxone miniserver_gen_1_firmware | v < 11.1.9.3 | 11.1.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.