CVE-2021-27941 | BDVDB-2026-153253 Detail

Description#

Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and through 4.9.1 on iOS) allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during a device pairing process.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US
https://apps.apple.com/us/app/ewelink-smart-home/id1035163158
https://github.com/salgio/eWeLink-QR-Code

Exploit#

No public exploit known

History#

Version 12021-05-06Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.