Medium severity · published Jul 19, 2019
CVE-2019-12821
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code
4.8
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
I3 Firmware · Jisiwei
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12821
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12821
www.kth.se
https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
More from I3 Firmware
5.6
CVE-2019-12820
A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner