CVE-2020-12702

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dl.acm.org/doi/abs/10.1145/3411498.3419965Third Party Advisory
https://github.com/salgio/ESPTouchCatcherExploit, Third Party Advisory
https://play.google.com/store/apps/details?id=com.coolkit&hl=en_USProduct, Third Party Advisory
https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.beExploit, Third Party Advisory
https://dl.acm.org/doi/abs/10.1145/3411498.3419965Third Party Advisory
https://github.com/salgio/ESPTouchCatcherExploit, Third Party Advisory
https://play.google.com/store/apps/details?id=com.coolkit&hl=en_USProduct, Third Party Advisory
https://www.youtube.com/watch?v=DghYH7WY6iE&feature=youtu.beExploit, Third Party Advisory

Timeline

Published: Feb 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-127036.1UliCMS before 2020.2 has XSS during PackageController uninstall.CVE-2020-127046.1UliCMS before 2020.2 has PageController stored XSS.CVE-2020-127056.1Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.CVE-2020-127065.4Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go CVE-2020-127076.1An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used aga CVE-2020-127086.1Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the ca CVE-2020-12717.8An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.To exploit this vulnerabil CVE-2020-127127.5A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attack CVE-2020-127137.2An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Mes CVE-2020-127145.9An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1 CVE-2020-127158.8RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.CVE-2020-127176.5The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contac