CVE-2020-11925 - Vulnerability Details - OpenCVE

An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.00298.

Key SSVC decision points have not yet been added.

Vendors	Products
Luvion	Grand Elite 3 Connect Grand Elite 3 Connect Firmware

Configuration 1 [-]

AND

cpe:2.3:o:luvion:grand_elite_3_connect_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:luvion:grand_elite_3_connect:-:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Jul/14
https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-04-02T15:41:46

Updated: 2024-08-04T11:42:00.824Z

Reserved: 2020-04-19T00:00:00

Link: CVE-2020-11925

Vulnrichment

Updated: 2024-08-04T11:42:00.824Z

NVD

Status : Modified

Published: 2021-04-02T16:15:13.570

Modified: 2024-11-21T04:58:55.160

Link: CVE-2020-11925

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2020-11925", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-04T11:42:00.824Z", "dateReserved": "2020-04-19T00:00:00", "datePublished": "2021-04-02T15:41:46"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-30T00:07:45.687817"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/"}, {"name": "20240729 Bunch of IoT CVEs", "tags": ["mailing-list"], "url": "http://seclists.org/fulldisclosure/2024/Jul/14"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "datePublic": "2021-02-22T00:00:00"}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-521", "lang": "en", "description": "CWE-521 Weak Password Requirements"}]}], "affected": [{"vendor": "luvion", "product": "grand_elite_3_connect", "cpes": ["cpe:2.3:h:luvion:grand_elite_3_connect:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2020-02-25", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-30T14:43:33.340297Z", "id": "CVE-2020-11925", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-30T14:47:12.739Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:42:00.824Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/", "tags": ["x_transferred"]}, {"name": "20240729 Bunch of IoT CVEs", "tags": ["mailing-list", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2024/Jul/14"}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Jul/14", "name": "20240729 Bunch of IoT CVEs", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:42:00.824Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2020-11925", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-30T14:43:33.340297Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:luvion:grand_elite_3_connect:-:*:*:*:*:*:*:*"], "vendor": "luvion", "product": "grand_elite_3_connect", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2020-02-25"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "CWE-521 Weak Password Requirements"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-30T14:47:05.858Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2021-02-22T00:00:00", "references": [{"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/"}, {"url": "http://seclists.org/fulldisclosure/2024/Jul/14", "name": "20240729 Bunch of IoT CVEs", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-30T00:07:45.687817"}}}, "cveMetadata": {"cveId": "CVE-2020-11925", "state": "PUBLISHED", "dateUpdated": "2024-08-04T11:42:00.824Z", "dateReserved": "2020-04-19T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2021-04-02T15:41:46", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:luvion:grand_elite_3_connect_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E09ADD9-BEF1-4065-BA45-B8A78D66D3B4", "versionEndIncluding": "2020-02-25", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:luvion:grand_elite_3_connect:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF22CFEE-FD90-45B3-BC81-CA85979F3C04", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Luvion Grand Elite 3 Connect hasta el 25-02-2020. La autenticaci\u00f3n del dispositivo es basada en un nombre de usuario y una contrase\u00f1a. Las credenciales de root son las mismas en todos los dispositivos de este modelo."}], "id": "CVE-2020-11925", "lastModified": "2024-11-21T04:58:55.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2021-04-02T16:15:13.570", "references": [{"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2024/Jul/14"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2024/Jul/14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitor/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-521"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}