CVE-2024-48548

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.

Score

CVSS 3.1 9.3 Critical

Status

Deferred - cve@mitre.org

Published

2024-10-24

Last modified

2024-10-24

Weaknesses

CWE-863

Affected products

• Cloud Smart Lock Firmware (Cloud Smart Lock)

References

• https://cloudsmartlock.com/m/app.html
• https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.seamooncloud.cloudsmartlock/com.seamooncloud.clo…