CVE-2020-11539

Katalog CVE

CVSS 8.1 · High EPSS 1,0%

Kerentanan Missing Authentication for Critical Function pada titan sf rush smart band firmware. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.

Rincian

Terbit di NVD

22 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-319: Cleartext Transmission of Sensitive Information
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/the-girl-who-lived/CVE-2020-11539/ exploit · advisory pihak ketiga
• https://medium.com/%40sayliambure/hacking-a-5-smartband-824763ab6e8f