The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.
References
| Link | Resource |
|---|---|
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt | Third Party Advisory |
| https://www.syss.de/pentest-blog/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Jun 2021, 16:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:hom.ee:brain_cube_firmware:2.28.4:*:*:*:*:*:*:* |
cpe:2.3:o:hom.ee:brain_cube_core:2.28.4:*:*:*:*:*:*:* cpe:2.3:o:hom.ee:brain_cube_core:2.28.2:*:*:*:*:*:*:* |
27 May 2021, 02:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-345 | |
| References | (MISC) https://www.syss.de/pentest-blog/ - Third Party Advisory | |
| References | (MISC) https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-026.txt - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 6.8 |
| CPE | cpe:2.3:o:hom.ee:brain_cube_firmware:2.28.2:*:*:*:*:*:*:* cpe:2.3:h:hom.ee:brain_cube:-:*:*:*:*:*:*:* cpe:2.3:o:hom.ee:brain_cube_firmware:2.28.4:*:*:*:*:*:*:* |
20 May 2021, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-20 14:15
Updated : 2024-02-04 21:47
NVD link : CVE-2020-24395
Mitre link : CVE-2020-24395
CVE.ORG link : CVE-2020-24395
JSON object : View
Products Affected
hom.ee
- brain_cube_core
- brain_cube
CWE
CWE-345
Insufficient Verification of Data Authenticity