Security experts from Cisco Talos have found two remote code execution (RCE) vulnerabilities in the Cosori Smart Air Fryer. The Cosori Smart Air Fryer is an appliance with smart capabilities that cooks food with a variety of methods and settings. Users can control the device via Wi-Fi, they can start and stop cooking, look up recipe guides and monitor cooking status.
The flaws could be exploited by threat actors to take over the devices and perform a broad range of malicious actions, some of the issues could be only exploited by attackers with physical access to the air fryer.
“TALOS-2020-1216 (CVE-2020-28592) and TALOS-2020-1217 (CVE-2020-28593) are remote code execution vulnerabilities that could allow an attacker to remotely inject code into the device. This could hypothetically allow an adversary to change temperatures, cooking times and settings on the air fryer, or start it without the user’s knowledge. The adversary must have physical access to the air fryer for some of these vulnerabilities to work.” reads the post published by Talos.
The CVE-2020-28592 and CVE-2020-28593 flaws affect the Cosori Smart 5.8-Quart Air Fryer CS158-AF (v.1.1.0). The CVE-2020-28592 is a heap-based buffer overflow vulnerability that resides in the configuration server functionality of the smart fryer. The vulnerability could be exploited by sending a packet containing a specially crafted JSON object to the device.
The CVE-2020-28593 is an unauthenticated backdoor that resides in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. The vulnerability could be exploited by sending a packet containing a specially crafted JSON object to the device.
Cisco Talos experts disclosed these vulnerabilities despite they have yet to be fixed by the vendor because Cosori failed to address them in a 90-day period of Cisco’s vulnerability disclosure policy.
Talos team released SNORT rule “56729” that allow to detect exploitation attempts against these vulnerabilities.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, smart air fryer)
[adrotate banner=”5″]
[adrotate banner=”13″]
FBI warns Silent Ransom Group has targeted U.S. law firms for 2 years using callback…
The U.S. indicted Russian Rustam Gallyamov for leading the Qakbot botnet, which infected 700K+ devices…
Law enforcement operation codenamed 'Operation RapTor' led to the arrest of 270 dark web vendors…
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Samsung MagicINFO 9 Server vulnerability to its…
Signal implements new screen security on Windows 11, blocking screenshots by default to protect user…
This website uses cookies.
