Improper Authentication in EXTRUN ilbo App
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2020-5532 |
| CWE-ID | CWE-287 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
ilbo App for Android Hardware solutions / Security hardware applicances ilbo App for iOS Hardware solutions / Security hardware applicances |
| Vendor | EXTRUN Ltd. |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Improper Authentication
EUVDB-ID: #VU25347
Risk: Low
CVSSv3.1: 3.1 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2020-5532
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to insufficient authentication. A remote authenticated attacker on the local network can view the images which were recorded by the other user's ilbo device.
MitigationInstall updates from vendor's website.
Vulnerable software versionsilbo App for Android: before 1.1.8
ilbo App for iOS: before 1.2.0
External linkshttp://jvn.jp/en/jp/JVN35496038/index.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
