CVE-2020-11922

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-02 · updated 2026-06-17
Weakness: CWE-200

Description

An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)

Affected products

Wizconnected A60 Colors Firmware: 1.14.0

References

http://seclists.org/fulldisclosure/2024/Jul/14
https://cwe.mitre.org/data/definitions/201.html
https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/
http://seclists.org/fulldisclosure/2024/Jul/14
https://cwe.mitre.org/data/definitions/201.html
https://www.eurofins-cybersecurity.com/news/connected-devices-wiz-smart-lightbulbs/

Get alerted when CVE-2020-11922 or the next vulnerability affects your stack