title: SiHAS Improper Authentication vulnerability
description: There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.
problem types: CWE-287 Improper Authentication
affected:
{
platforms: Android, iOS
product: SiHAS firmware
vendor: Shina System Co.,Ltd
versions:
status: affected, version: 1.xx
}
{
platforms: Android, iOS
product: SiHAS old app
vendor: Shina System Co.,Ltd
versions:
status: affected, version: old app
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]