CVE-2020-11539

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.

CVSS v3 8.1 HIGH
CVSS v2.0 4.8 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 6.5 / Impact : 4.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/the-girl-who-lived/CVE-2020-11539/	Exploit Third Party Advisory
https://medium.com/%40sayliambure/hacking-a-5-smartband-824763ab6e8f

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*

cpe:2.3:h:titan:sf_rush_smart_band:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-04-22 14:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-11539

Mitre link : CVE-2020-11539

CVE.ORG link : CVE-2020-11539

JSON object : View

Products Affected

titan

sf_rush_smart_band
sf_rush_smart_band_firmware

CWE

CWE-306

Missing Authentication for Critical Function

CWE-319

Cleartext Transmission of Sensitive Information

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2020-11539", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2020-04-22T14:15:12.347", "references": [{"url": "https://github.com/the-girl-who-lived/CVE-2020-11539/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40sayliambure/hacking-a-5-smartband-824763ab6e8f", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en los dispositivos Tata Sonata Smart SF Rush versi\u00f3n 1.12. Se ha identificado que la banda inteligente no tiene emparejamiento (modo 0 nivel de seguridad Bluetooth LE) Los datos que son transmitidos por el aire no est\u00e1n cifrados. Adem\u00e1s de esto, los datos que son enviados a la banda inteligente no tienen ninguna autenticaci\u00f3n o comprobaci\u00f3n de firma. Por lo tanto, cualquier atacante puede controlar un par\u00e1metro del dispositivo."}], "lastModified": "2023-11-07T03:14:59.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:titan:sf_rush_smart_band_firmware:1.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A3BCA33-7863-4A36-9A2C-653D50AC29D7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:titan:sf_rush_smart_band:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "74F67F39-3EF1-45B1-AEF8-28F9F57EF40D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}