Home

Description

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.

PUBLISHED Reserved 2024-10-08 | Published 2024-10-24 | Updated 2024-10-24 | Assigner mitre

References

cloudsmartlock.com/m/app.html

github.com/...udsmartlock/com.seamooncloud.cloudsmartlock.md

cve.org (CVE-2024-48548)

nvd.nist.gov (CVE-2024-48548)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.