Vulnerabilities

TI-2016-04377 CVE-2016-5059 · GHSA-qgcx-3mfx-m26m

Information disclosure in OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26

LOW 31

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01153 Published 2017-04-10 No fix listed CWE-200

TI-2016-04376 CVE-2016-5058 · GHSA-5q57-6p8j-x4r4

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

LOW 35

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01148 Published 2017-04-10 No fix listed CWE-284

TI-2016-04375 CVE-2016-5057 · GHSA-hgqq-6c8m-cfcc

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

LOW 35

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2017-04-10 No fix listed CWE-254

TI-2016-04374 CVE-2016-5056 · GHSA-hqhq-pxhf-f4jj

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

LOW 35

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00934 Published 2017-04-10 No fix listed CWE-326

TI-2016-04373 CVE-2016-5055 · GHSA-r8fv-qm2f-vc68

Cross-site scripting in OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26

LOW 29

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00819 Published 2017-04-10 No fix listed CWE-79

Vulnerabilities

Filters

Information disclosure in OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

Cross-site scripting in OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26