Exploitation Summary
EIP tracks 2 public exploits for CVE-2022-35513. PoCs published by p1ckzi.
AI-analyzed exploit summary This exploit decrypts weakly encrypted passwords stored by Blink1Control2 (<= 2.2.7) using a hardcoded salt, password, and AES-192-ECB method. It targets the insecure password storage mechanism exposed via the /blink1/input API endpoint.
Description
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
Exploits (2)
This exploit decrypts weakly encrypted passwords stored by Blink1Control2 (<= 2.2.7) using a hardcoded salt, password, and AES-192-ECB method. It targets the insecure password storage mechanism exposed via the /blink1/input API endpoint.
This repository provides a functional PoC script to decrypt weakly encrypted passwords stored by blink1control2 (versions <= 2.2.7) via the /blink1/input API endpoint. The exploit leverages insecure encryption methods to reverse ciphertext into plaintext passwords.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N