CVE-2020-8790
📋 TL;DR
CVE-2020-8790 allows remote attackers to brute-force weak passwords on the OKLOK mobile app for Fingerprint Bluetooth Padlock FB50, potentially gaining unauthorized access to the lock system. This affects users of the OKLOK app version 3.1.1 paired with FB50 padlock firmware 2.3.
💻 Affected Systems
- OKLOK mobile companion app
- Fingerprint Bluetooth Padlock FB50
📦 What is this software?
Oklok by Oklok Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all connected padlocks, allowing physical access to secured locations and potential theft or sabotage.
Likely Case
Unauthorized access to individual padlocks through automated password guessing attacks.
If Mitigated
Limited to failed login attempts with no successful breaches if strong passwords and rate limiting are enforced.
🎯 Exploit Status
Proof-of-concept code is available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check app stores for updated versions of OKLOK app and manufacturer website for FB50 firmware updates.
🔧 Temporary Workarounds
Disable Bluetooth when not in use
allPrevents remote attacks by disabling Bluetooth connectivity to the padlock.
Use strong unique password
allImplement complex passwords with length >12 characters including special characters to resist brute force.
🧯 If You Can't Patch
- Discontinue use of vulnerable padlock/app combination for sensitive applications
- Implement physical security monitoring and alarms as compensating controls
🔍 How to Verify
Check if Vulnerable:
Check OKLOK app version in app settings and FB50 firmware version via manufacturer documentation.Check Version:
No standard command - check within mobile app settings and padlock documentationVerify Fix Applied:
Verify updated app version >3.1.1 and test authentication attempt limits.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from unknown devices
- Unusual Bluetooth connection patterns
Network Indicators:
- Bluetooth scanning activity near padlock locations
- Unusual Bluetooth MAC addresses attempting connections
SIEM Query:
No standard SIEM query available for Bluetooth-based attacks