Vulnerability · Published Feb 24, 2021 · Assigned by mitre
CVE-2020-12702
Medium 4.6
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)4.6Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.
Affected products (as reported)
References
- https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US x_refsource_MISC
- https://dl.acm.org/doi/abs/10.1145/3411498.3419965 x_refsource_MISC
- https://github.com/salgio/ESPTouchCatcher x_refsource_MISC
- https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.be x_refsource_MISC