Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-9483

Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspond to the actual person at the door.

Published

2019-03-01T05:29:01.133

Last Modified

2024-11-21T04:51:42.390

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.1 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

4.9

Weaknesses

Type: Primary
CWE-327

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	amazon	ring_video_doorbell_firmware	< 3.4.7	Yes
Hardware	amazon	ring_video_doorbell	-	No

References

https://dojo.bullguard.com/dojo-by-bullguard/blog/ring/ Third Party Advisory ([email protected])
https://www.theverge.com/2019/2/27/18243296/ring-doorbell-hacked-fake-images-security-experts Third Party Advisory ([email protected])
https://dojo.bullguard.com/dojo-by-bullguard/blog/ring/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.theverge.com/2019/2/27/18243296/ring-doorbell-hacked-fake-images-security-experts Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)