CVE Feed

    Dashboard / CVE / CVE-2020-11015

    CVE-2020-11015

    A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be reviewed further. Applies to all (mostly ESP8266/ESP32) users. This has been fixed in firmware version 2.5.0.

    Published:Apr 30, 2020
    Last Modified:Apr 23, 2025
    EPS:Sep 29, 2022
    EPSS Score:0.00288
    CVSS Score:7.5

    Affected Products

    Vendor
    Thinx-device-api Project
    Product
    Thinx-device-api

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High