Cognitoys
Products
2- 3 CVEs
- 2 CVEs
Recent CVEs
5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18484 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | Cognitoys Dino devices allow XSS via the SSID. | ||
| CVE-2017-8867 | Med | 0.38 | 5.9 | 0.01 | Dec 11, 2017 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote server, allowing a malicious user to map encrypted traffic to a particular AES key index and gaining further access to… | ||
| CVE-2017-8866 | Med | 0.38 | 5.9 | 0.01 | Dec 11, 2017 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server. | ||
| CVE-2017-8865 | Med | 0.38 | 5.9 | 0.01 | Dec 11, 2017 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device. | ||
| CVE-2017-18485 | Med | 0.35 | 5.4 | 0.00 | Aug 8, 2019 | Cognitoys Dino devices allow profiles_add.html CSRF. |
- risk 0.40cvss 6.1epss 0.01
Cognitoys Dino devices allow XSS via the SSID.
- risk 0.38cvss 5.9epss 0.01
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote server, allowing a malicious user to map encrypted traffic to a particular AES key index and gaining further access to…
- risk 0.38cvss 5.9epss 0.01
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server.
- risk 0.38cvss 5.9epss 0.01
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device.
- risk 0.35cvss 5.4epss 0.00
Cognitoys Dino devices allow profiles_add.html CSRF.