CVE-2020-10876

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada oklok project oklok. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.

Rincian

Terbit di NVD

4 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-613: Insufficient Session Expiration

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://apps.apple.com/us/app/oklok/id1392287771 product · advisory pihak ketiga
• https://github.com/fierceoj/ownklok exploit · advisory pihak ketiga