Herowatch Go Server insecure direct object reference lets users reach others' data
Logged-in users can peek at other people's data.
Summary
In Herowatch Go Server, a logged-in user can change parameters to access or operate other users' data and functions. All versions are affected, and the product is no longer maintained.
Affected when
- Authenticated user account required
What to do
The product is no longer maintained, so there is no fixed version. The advisory recommends replacing it with a supported device.
Products and platforms
CVE IDs
Sources
- Write-up: twcert.org.tw (opens in a new tab) · twcert.org.tw (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen