osram lightify pro vulnerabilities

Latest osram lightify pro CVEs

Newest publication first

1. CVE-2016-5059 OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.

   Published 2017-04-10

   Medium·CVSS 6.5 EPSS 1.2%

   OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application.

2. CVE-2016-5058 OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

   Published 2017-04-10

   High·CVSS 7.5 EPSS 1.1%

   OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.

3. CVE-2016-5057 OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

   Published 2017-04-10

   High·CVSS 7.5 EPSS 1.2%

   OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.

4. CVE-2016-5056 OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

   Published 2017-04-10

   High·CVSS 7.5 EPSS 0.93%

   OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.

5. CVE-2016-5055 OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.

   Published 2017-04-10

   Medium·CVSS 6.1 EPSS 0.82%

   OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.