osram records

9 published records for vendor osram.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2016-5053No exploit	OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.osram · lightify home · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	2.7%	Apr 9, 2017
30Monitor	CVE-2016-5051No exploit	OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.osram · lightify home · CWE-200 Pre-auth Info leak	High7.5	—	1.4%	Apr 9, 2017
30Monitor	CVE-2016-5057No exploit	OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.osram · lightify pro · CWE-254 Pre-auth	High7.5	—	1.2%	Apr 9, 2017
30Monitor	CVE-2016-5054No exploit	OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.osram · lightify home · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	1.1%	Apr 9, 2017
30Monitor	CVE-2016-5058No exploit	OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.osram · lightify pro · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	1.1%	Apr 9, 2017
30Monitor	CVE-2016-5052No exploit	OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.osram · lightify home · CWE-254 Pre-auth	High7.5	—	1.1%	Apr 9, 2017
30Monitor	CVE-2016-5056No exploit	OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.osram · lightify pro · CWE-326 Pre-auth Weak crypto	High7.5	—	0.9%	Apr 9, 2017
26Monitor	CVE-2016-5059No exploit	OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/vosram · lightify pro · CWE-200 Info leak	Medium6.5	—	1.2%	Apr 9, 2017
24Monitor	CVE-2016-5055No exploit	OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.osram · lightify pro · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	Apr 9, 2017

CVE-2016-5053
40Plan
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
- Auth bypass
osram · lightify homeApr 9, 2017
CVE-2016-5051
30Monitor
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
osram · lightify homeApr 9, 2017
CVE-2016-5057
30Monitor
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
osram · lightify proApr 9, 2017
CVE-2016-5054
30Monitor
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
osram · lightify homeApr 9, 2017
CVE-2016-5058
30Monitor
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
osram · lightify proApr 9, 2017
CVE-2016-5052
30Monitor
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
osram · lightify homeApr 9, 2017
CVE-2016-5056
30Monitor
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Weak crypto
osram · lightify proApr 9, 2017
CVE-2016-5059
26Monitor
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/v
MediumCVSS 6.5No exploitEPSS 1%
- Info leak
osram · lightify proApr 9, 2017
CVE-2016-5055
24Monitor
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
osram · lightify proApr 9, 2017