Wemo: Difference between revisions - Consumer_Action

Line 25:

On May 16, 2023, multiple websites reported a Sternum study regarding a buffer overflow vulnerability in the Wemo Mini Smart Plug V2.<ref>https://sternumiot.com/iot-blog/mini-smart-plug-v2-vulnerability-buffer-overflow/</ref> The study mentions the device could be exploited through a program called pyWemo<ref>https://thehackernews.com/2023/05/serious-unpatched-vulnerability.html</ref> and potentially through cloud controls.<ref>https://www.theverge.com/2023/5/16/23725290/wemo-smart-plug-v2-smart-home-security-vulnerability</ref> In their official response, Wemo stated "we believe that bad actors cannot exploit this vulnerability unless they have access to the user’s local network"<ref>https://x.com/WEMOcares/status/1658963426230562819</ref> and "We discontinued the Wemo Mini Smart Plug v2 (F7C063) in 2020"<ref>https://x.com/WEMOcares/status/1658963635882938374</ref>, despite not making this information publicly available prior. During this report, the Wemo app hadn't been updated in 2 years, with the most recent update being on February 23, 2021, as previously mentioned.<ref name="AAS" />

===DNS activity===

Some users of Wemo have noticed their switches connect to multiple unrelated domains, such as to CNN and Fastly.<ref>https://www.reddit.com/r/WeMo/comments/1auslst/fun_fact_wemo_switches_act_as_a_dns_server/</ref> Other reports mention each Wemo device making 160,000+ DNS requests in a 24 hour timeframe.<ref>https://www.reddit.com/r/WeMo/comments/1auslst/comment/ktxkqx8/</ref><ref>https://www.reddit.com/r/WeMo/comments/1auslst/comment/krb0i1o/</ref>

==Products==

@@ Line 25: / Line 25: @@
 On May 16, 2023, multiple websites reported a Sternum study regarding a buffer overflow vulnerability in the Wemo Mini Smart Plug V2.<ref>https://sternumiot.com/iot-blog/mini-smart-plug-v2-vulnerability-buffer-overflow/</ref> The study mentions the device could be exploited through a program called pyWemo<ref>https://thehackernews.com/2023/05/serious-unpatched-vulnerability.html</ref> and potentially through cloud controls.<ref>https://www.theverge.com/2023/5/16/23725290/wemo-smart-plug-v2-smart-home-security-vulnerability</ref> In their official response, Wemo stated "we believe that bad actors cannot exploit this vulnerability unless they have access to the user’s local network"<ref>https://x.com/WEMOcares/status/1658963426230562819</ref> and "We discontinued the Wemo Mini Smart Plug v2 (F7C063) in 2020"<ref>https://x.com/WEMOcares/status/1658963635882938374</ref>, despite not making this information publicly available prior. During this report, the Wemo app hadn't been updated in 2 years, with the most recent update being on February 23, 2021, as previously mentioned.<ref name="AAS" />
+===DNS activity===
+Some users of Wemo have noticed their switches connect to multiple unrelated domains, such as to CNN and Fastly.<ref>https://www.reddit.com/r/WeMo/comments/1auslst/fun_fact_wemo_switches_act_as_a_dns_server/</ref> Other reports mention each Wemo device making 160,000+ DNS requests in a 24 hour timeframe.<ref>https://www.reddit.com/r/WeMo/comments/1auslst/comment/ktxkqx8/</ref><ref>https://www.reddit.com/r/WeMo/comments/1auslst/comment/krb0i1o/</ref>
 ==Products==