CVE-2023-6913
📋 TL;DR
A session hijacking vulnerability in Imou Life app version 6.7.0 allows attackers to hijack user accounts through QR code functionality. The vulnerability occurs when scanning new devices triggers WebView execution without user prompts, enabling phishing attacks. This affects all users of the vulnerable app version.
💻 Affected Systems
- Imou Life mobile application
📦 What is this software?
Imou Life by Imoulife
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attackers to access camera feeds, personal data, and control smart devices connected to the compromised account.
Likely Case
Session hijacking leading to unauthorized access to smart home devices and potential privacy violations through camera access.
If Mitigated
Limited impact if users avoid scanning unknown QR codes and use updated app versions.
🎯 Exploit Status
Exploitation requires user to scan malicious QR code, but no authentication needed beyond that action.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.8.0 or later (based on typical versioning patterns)
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app
Restart Required: Yes
Instructions:
1. Open Google Play Store or Apple App Store. 2. Search for 'Imou Life'. 3. If update available, tap 'Update'. 4. Restart the application after update completes.
🔧 Temporary Workarounds
Disable QR Code Scanning
allAvoid using QR code functionality to add new devices until patched
Network Segmentation
allIsolate smart home devices on separate network from personal devices
🧯 If You Can't Patch
- Uninstall the vulnerable app version and use web interface if available
- Implement strict network monitoring for unusual device connections
🔍 How to Verify
Check if Vulnerable:
Check app version in settings: Open Imou Life app > Settings > About > Check version numberCheck Version:
Not applicable - check through app settings UIVerify Fix Applied:
Verify app version is 6.8.0 or higher after update📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from new locations
- Unusual device addition patterns
- QR code scan events from unknown sources
Network Indicators:
- Unexpected connections to Imou cloud services
- Traffic from new IP addresses accessing devices
SIEM Query:
source="imou_app" AND (event="qr_scan" OR event="device_added") | stats count by user, src_ip