CVE-2020-27488
First published: Wed Jan 13 2021(Updated: )
Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices (or attackers who are spoofing these devices) can continue to use an unauthenticated cloud service for an indeterminate time period (possibly forever). Once an individual device's firmware is updated, and authentication occurs once, the cloud service recategorizes the device so that authentication is subsequently always required, and spoofing cannot occur.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Loxone Miniserver Gen 1 | <11.1.9.3 | |
| Loxone Miniserver |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-27488?
CVE-2020-27488 is classified as a high severity vulnerability due to its potential to allow unauthorized access to cloud services.
How do I fix CVE-2020-27488?
To fix CVE-2020-27488, update the firmware of the Loxone Miniserver devices to version 11.1.9.3 or later.
Who is affected by CVE-2020-27488?
CVE-2020-27488 affects Loxone Miniserver devices running firmware versions earlier than 11.1.9.3.
What is the impact of CVE-2020-27488?
The impact of CVE-2020-27488 is that it allows attackers to spoof devices and potentially access unauthenticated cloud services.
What type of vulnerability is CVE-2020-27488?
CVE-2020-27488 is an authentication vulnerability that arises from insufficient signature verification in Loxone Miniserver firmware.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/loxone
- canonical/loxone miniserver gen 1
- canonical/loxone miniserver