CVE-2018-16242

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.

Score

CVSS 3.0 5.3 Medium

Status

Modified - cve@mitre.org

Published

2018-09-14

Last modified

2024-08-05

Weaknesses

CWE-294

Affected products

• Obike-stationless Bike Sharing (O.bike)
• Smart Locker Firmware (O.bike)

References

• https://seclists.org/bugtraq/2018/Sep/30