Vulnerability · Published Dec 19, 2023 · Assigned by INCIBE
CVE-2023-6913Session Hijacking on Imou Life app
High 8.1
In plain English
A high-severity session fixation in Imou Life app from Imou. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Imou | Imou Life app | 6.7.0 |
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N