Vulnerabilities > CVE-2019-15304 - Insecure Default Initialization of Resource vulnerability in Progradegrill Wifi Grilling Thermometer Firmware 1.0050006

047910
CVSS 9.1 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
progradegrill
CWE-1188
critical
NVD
Published: 2019-08-26
Updated: 2024-11-21

Summary

Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding.

Vulnerable Configurations

Part Description Count
OS
Progradegrill
1
Hardware
Progradegrill
1

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/154221/progreadelierda-disclosehardcoded.txt
idPACKETSTORM:154221
last seen2019-08-26
published2019-08-26
reporterTim Tepatti
sourcehttps://packetstormsecurity.com/files/154221/ProGrade-Lierda-Grill-Temperature-1.00_50006-Hardcoded-Credentials.html
titleProGrade/Lierda Grill Temperature 1.00_50006 Hardcoded Credentials

References