CVE-2020-10876
📋 TL;DR
The OKLOK mobile app for Fingerprint Bluetooth Padlock FB50 has insufficient security controls for password reset verification codes. Attackers can brute-force the 4-digit code to bypass email verification and hijack user accounts. This affects users of OKLOK app version 3.1.1 with FB50 padlock version 2.3.
💻 Affected Systems
- OKLOK mobile companion app
- Fingerprint Bluetooth Padlock FB50
📦 What is this software?
Oklok by Oklok Project
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attacker to lock legitimate users out of their padlock accounts and potentially access personal information.
Likely Case
Unauthorized password changes leading to denial of service for legitimate padlock owners.
If Mitigated
Minimal impact with proper rate limiting and timeout mechanisms in place.
🎯 Exploit Status
Simple brute-force attack against 4-digit code with no rate limiting. Public GitHub repository demonstrates exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
1. Check app store for updated OKLOK app version
2. Update to latest version if available
3. Check for padlock firmware updates through the app
🔧 Temporary Workarounds
Disable password reset functionality
allTemporarily disable password reset feature in app settings if available
Enable two-factor authentication
allIf app supports additional authentication factors, enable them
🧯 If You Can't Patch
- Monitor account activity for unauthorized password reset attempts
- Consider discontinuing use of vulnerable app version until patch is available
🔍 How to Verify
Check if Vulnerable:
Check app version in settings: if OKLOK version is 3.1.1 and paired with FB50 padlock version 2.3, system is vulnerable.Check Version:
Check app version in mobile device settings under 'Apps' or 'Application Manager'Verify Fix Applied:
Verify app has been updated to version newer than 3.1.1 and padlock firmware is newer than 2.3.📡 Detection & Monitoring
Log Indicators:
- Multiple failed verification attempts from single IP
- Rapid succession of password reset requests
Network Indicators:
- Unusual patterns of authentication API calls
- High volume of requests to verification endpoints
SIEM Query:
source="oklok_app" AND (event="verification_failed" count>10 within 1min) OR (event="password_reset" count>5 within 5min)