ABUP IoT Cloud Platform Vulnerability: When Privileges Go Rogue!
View CSAF: The ABUP IoT Cloud Platform has a vulnerability that allows unauthorized access to device profiles. Although it’s been fixed, users should update their authentication info for added safety. Remember, a cloud without a silver lining may just rain on your IoT parade!
Hot Take:
ABUP’s IoT Cloud Platform just had a “Come One, Come All” vulnerability party. Apparently, it was BYOJ (Bring Your Own JWT). But don’t worry, the door’s been closed, and the snacks (device profiles) are safe… for now.
Key Points:
- ABUP IoT Cloud Platform had a vulnerability allowing unauthorized access via JWTs.
- Vulnerability scored CVSS v4 5.9, indicating moderate risk.
- Exploit could escalate privileges to access any device on the platform.
- Vendor removed the vulnerable method, but ABUP was non-responsive to CISA.
- No public exploitation of this vulnerability reported at the time.
Already a member? Log in here