CVE-2020-27266
19.01.2021, 22:15
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy.Enginsight
| Vendor | Product | Version |
|---|---|---|
| sooil | anydana-a_firmware | 𝑥 < 3.0 |
| sooil | anydana-i_firmware | 𝑥 < 3.0 |
| sooil | diabecare_rs_firmware | 𝑥 < 3.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-603 - Use of Client-Side AuthenticationA client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.