What is CVE-2018-15479?

CVE-2018-15479 is a medium-severity vulnerability in Mystrom Wifi Bulb, classified under Improper Authentication. CVSS score: 6.5/10. Published 2018-08-30.

How severe is CVE-2018-15479?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Mystrom Wifi Bulb

CVE-2018-15479

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to cloud communication. This lack of device authentication allowed an attacker to impersonate any device by guessing or learning their MAC address.

Vulnerability class: Broken Authentication

EPSS: 0.008 (52.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-15479?: CVE-2018-15479 is a medium-severity vulnerability in Mystrom Wifi Bulb, classified under Improper Authentication. CVSS score: 6.5/10. Published 2018-08-30.
How severe is CVE-2018-15479?: Medium severity. CVSS v3 base score is 6.5 out of 10.