CVE-2021-27499
02.08.2021, 21:15
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-the-middle attackers to tamper with messages.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ypsomed | mylife | 𝑥 < 1.7.5 |
| ypsomed | mylife_cloud | 𝑥 < 1.7.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-329 - Generation of Predictable IV with CBC ModeThe product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
- CWE-330 - Use of Insufficiently Random ValuesThe software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.