CVE Feed

    Dashboard / CVE / CVE-2017-7729

    CVE-2017-7729

    On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.

    Published:Jul 11, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 11, 2017
    EPSS Score:0.0011
    CVSS Score:7.5

    Affected Products

    Vendor
    Ismartalarm
    Product
    Cubeone
    Vendor
    Ismartalarm
    Product
    Cubeone Firmware

    Exploits

    http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/

    Related CVEs

    CVE-2018-16224 (CVSS 5.3) — Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attac…
    CVE-2017-13663 (CVSS 7.5) — Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to dec…
    CVE-2017-13664 (CVSS 9.8) — Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to exec…
    CVE-2017-7726 (CVSS 7.5) — iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.…
    CVE-2017-7728 (CVSS 9.8) — On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., set…
    CVE-2017-7730 (CVSS 7.5) — iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High