CVE-2019-15304 — CRITICAL (9.1)

Vulnerability Description

Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding.

CVSS Score

9.1

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Progradegrill	Wifi Grilling Thermometer Firmware	1.00_50006
Progradegrill	Wifi Grilling Thermometer	-

Related Weaknesses (CWE)

CWE-1188

References

http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.Third Party AdvisoryVDB Entry
http://progradegrill.com/wifi-grilling-thermometer/Product
http://seclists.org/fulldisclosure/2019/Aug/24Mailing ListThird Party Advisory
https://www.joesandbox.com/analysis/287596/0/html
http://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.Third Party AdvisoryVDB Entry
http://progradegrill.com/wifi-grilling-thermometer/Product
http://seclists.org/fulldisclosure/2019/Aug/24Mailing ListThird Party Advisory
https://www.joesandbox.com/analysis/287596/0/html

FAQ

What is CVE-2019-15304?

CVE-2019-15304 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented...

How severe is CVE-2019-15304?

CVE-2019-15304 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-15304?

Check the references section above for vendor advisories and patch information. Affected products include: Progradegrill Wifi Grilling Thermometer Firmware, Progradegrill Wifi Grilling Thermometer.