CVE-2018-15480 - CVE House
Back to Database
Status published High CVE-2018-15480

An issue was discovered in myStrom WiFi Switch V1 before...

Vulnerability Description

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. The cloud API had a hidden parameter, which allowed an authenticated user to reconfigure the server URL for a device registered to their account. In combination with an insecure device registration vulnerability, this allowed an attacker to reconfigure a maliciously registered device to their own rogue replica of the myStrom API and issue commands to the device, including firmware update commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-15480

Credits & Attribution

No credits recorded in the NVD database.

References

More from mystrom

View All →
CVE-2018-15479
An issue was discovered in myStrom WiFi Switch V1 before...
Medium 6.5
CVE-2018-15478
An issue was discovered in myStrom WiFi Switch V1 before...
High 8.1
CVE-2018-15477
myStrom WiFi Switch V1 devices before 2.66 did not sanitize...
Critical 9.8
CVE-2018-15476
An issue was discovered in myStrom WiFi Switch V1 before...
High 8.1

Affected Vendor

Affected Software

wifi switch firmware, wifi button plus firmware, wifi button firmware, wifi switch eu firmware, wifi bulb firmware, wifi led strip firmware
Vulnerable Versions:
0

Timeline

Official Publish: August 30th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.