CVE-2020-11922

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119235.5An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.CVE-2020-119245.5An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-d CVE-2020-119258.8An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password CVE-2020-119267.5An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a userna CVE-2020-119289.8In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_quer CVE-2020-11937.8<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An CVE-2020-119306.1The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature withi CVE-2020-119313.3An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of int CVE-2020-119322.3It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.CVE-2020-119336.8cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical att CVE-2020-119345.9It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL(CVE-2020-119355.5It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vul