CVE-2020-11922

MEDIUM

WiZ Colors A60 1.14.0 - Unnecessary Sensitive Information Exposure to Cloud Server

Title source: llm

Description

An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)

References (3)

Core 3

Core References

Third Party Advisory

https://cwe.mitre.org/data/definitions/201.html

Exploit, Third Party Advisory

https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/

Mailing List mailing-list

http://seclists.org/fulldisclosure/2024/Jul/14

Scores

CVSS v3 4.3

EPSS 0.0112

EPSS Percentile 62.2%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (1)

wizconnected/a60_colors_firmware 1.14.0

Published Apr 02, 2021

Tracked Since Feb 18, 2026