CVE-2023-34625
HIGHShowmojo Mojobox Firmware - Authentication Bypass
Title source: ruleDescription
ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time. Alternatively, an attacker with physical access to the device on which the Android app is installed, can obtain the latest BLE messages via the app logs and use them for opening the lock.
Scores
CVSS v3
8.1
EPSS
0.0002
EPSS Percentile
5.5%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Classification
CWE
CWE-294
Status
published
Affected Products (1)
showmojo/mojobox_firmware
Timeline
Published
Jul 20, 2023
Tracked Since
Feb 18, 2026