CWE Code: 255
Vulnerability Type: sql_injection
CVSS Score: 6.8
CWE Name:  Credentials Management
Summary: the time-based one-time-password (totp) function in the application logic of the green electronics rainmachine mini-8 (2nd generation) uses the administrator's password hash to generate a 6-digit temporary passcode that can be used for remote and local access, aka a "use of password hash instead of password for authentication" issue. this is exploitable by an attacker who discovers a hash value in the rainmachine-settings.sqlite file.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-11-01
Last Modified Date: 2019-02-22