Herowatch Mini ADB service lacks authentication, giving attackers a device shell
Anyone can connect to a Herowatch Mini device and control it.
Summary
The ADB service on About Time Technologies' Herowatch Mini has no authentication, so an unauthenticated remote attacker can open an ADB shell and access device resources. The product is no longer maintained.
Affected when
- ADB service reachable over the network
What to do
No fixed version exists. The product is no longer maintained, so replace it with a supported device.
Update these devices now.
- About Time Technologies Herowatch Mini
Products and platforms
CVE IDs
Sources
- Write-up: twcert.org.tw (opens in a new tab) · twcert.org.tw (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen