CVE-2018-15479
MEDIUMmyStrom WiFi Switch/LED Strip/Button < 3.80, Bulb < 2.58 - Improper Device Authentication
Title source: llmDescription
An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip before 3.80, WiFi Button before 2.73, and WiFi Button Plus before 2.73. Devices did not authenticate themselves to the cloud in device to cloud communication. This lack of device authentication allowed an attacker to impersonate any device by guessing or learning their MAC address.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2018-15476ff.txt
Scores
CVSS v3
6.5
EPSS
0.0079
EPSS Percentile
51.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-287
Status
published
Products (6)
mystrom/wifi_bulb_firmware
< 2.58
mystrom/wifi_button_firmware
< 2.73
mystrom/wifi_button_plus_firmware
< 2.73
mystrom/wifi_led_strip_firmware
< 3.80
mystrom/wifi_switch_eu_firmware
< 3.80
mystrom/wifi_switch_firmware
< 2.66
Published
Aug 30, 2018
Tracked Since
Feb 18, 2026