CVE-2023-6998
📋 TL;DR
This vulnerability allows attackers to bypass the lockscreen on eWeLink mobile apps, potentially accessing the application without proper authentication. It affects Android and iOS users running eWeLink versions before 5.2.0. The issue stems from improper privilege management in the application's security controls.
💻 Affected Systems
- CoolKit Technology eWeLink
📦 What is this software?
Ewelink by Coolkit
Ewelink by Coolkit
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access to a device could bypass the lockscreen and gain unauthorized access to the eWeLink app, potentially controlling connected smart home devices, viewing sensitive information, or modifying device settings.
Likely Case
Local attackers or users with brief physical access to a device could bypass the lockscreen to access the eWeLink application without authorization, compromising smart home device control and user privacy.
If Mitigated
With proper device physical security controls and updated software, the risk is limited to authorized users only, maintaining normal application functionality.
🎯 Exploit Status
Exploitation requires physical access to the mobile device. The specific bypass method is not publicly documented but is described as a lockscreen bypass vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.0 and later
Vendor Advisory: https://ewelink.cc/app/
Restart Required: No
Instructions:
1. Open Google Play Store (Android) or App Store (iOS). 2. Search for 'eWeLink'. 3. If an update is available, tap 'Update'. 4. Ensure version is 5.2.0 or higher.
🔧 Temporary Workarounds
Disable App Lockscreen
allTemporarily disable the lockscreen feature in eWeLink app settings to remove the vulnerable component
Enable Device-Level Security
allUse device-level lockscreen/passcode instead of app-level lockscreen for protection
🧯 If You Can't Patch
- Disable the eWeLink app lockscreen feature in settings
- Implement strict physical security controls for mobile devices
🔍 How to Verify
Check if Vulnerable:
Check eWeLink app version in app settings or device app store. If version is below 5.2.0, the device is vulnerable.Check Version:
Open eWeLink app → Settings → About → Check version numberVerify Fix Applied:
Confirm eWeLink app version is 5.2.0 or higher in app settings or device app store.📡 Detection & Monitoring
Log Indicators:
- Multiple failed lockscreen attempts followed by successful access
- Unusual access patterns to smart home devices
Network Indicators:
- Unusual device control commands from previously locked devices
SIEM Query:
Not applicable - this is a local mobile app vulnerability without network exploitation