Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-585
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;Updated: The impacted vendor has not responded or fixed the security issues.In another example of how connectivity can , researchers have disclosed two remote code execution (RCE) vulnerabilities in a smart air fryer. RCEs are often considered to be some of the most severe types of vulnerabilities as they allow attackers to remotely deploy code, potentially leading to the hijack of a system, remote tampering, and the execution of additional malware payloads.&nbsp; While targeting consumer products and executing an RCE may not have the same immediate impact as on a corporate network, it is still worth highlighting that just because a product we have in our home is considered 'smart,' it does not mean that it is safe.&nbsp; On Monday, researchers from Cisco Talos revealed the discovery in the Cosori Smart Air Fryer, a Wi-Fi-connected kitchen product that leverages the internet to give users remote control over cooking temperature, times, and settings.&nbsp; However, it is the same connectivity -- when coupled with security flaws -- that also allows others to take control of the device, too.&nbsp; The team tested the Cosori Smart 5.8-Quart Air Fryer CS158-AF (v.1.1.0) and discovered and . The first vulnerability is caused by an unauthenticated backdoor and the second, a heap-based overflow issue -- both of which could be exploited via crafted traffic packets, although local access may be required for easier exploitation.&nbsp; The vulnerabilities have now been disclosed without any fix. According to Talos researchers, Cosori did not "respond appropriately" within the typical 90-day vulnerability disclosure period, and so -- perhaps -- now the vendor will consider issuing a patch now the issues are public.&nbsp; While the idea of your cooking utensils being held to ransom by threat actors may be far-fetched, the vulnerabilities represent what is a far wider problem: the general vulnerable state of Internet of Things (IoT) devices in our homes.&nbsp; Last week, researchers disclosed in four TCP/IP stacks commonly used by smart devices for communication purposes that could be weaponized to remotely hijack them. The security flaws, thought to impact over 100 million consumer, enterprise, and industrial devices, may be exploited to add vulnerable products to botnets or to obtain entry into linked networks.&nbsp; Update 23/4 20.56 BST:&nbsp;Cosori told ZDNet that "the scope of the vulnerability is limited to the local area network and cannot be controlled remotely through WAN," and a firmware update is due for release to patch the flaw on April 25.&nbsp;Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

/&gt;Updated: The impacted vendor has not responded or fixed the security issues.In another example of how connectivity can , researchers have disclosed two remote code execution (RCE) vulnerabilities in a smart air fryer. RCEs are often considered to be some of the most severe types of vulnerabilities as they allow attackers to remotely deploy code, potentially leading to the hijack of a system, remote tampering, and the execution of additional malware payloads.&nbsp; While targeting consumer products and executing an RCE may not have the same immediate impact as on a corporate network, it...

public

Charlie Osborne

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

zdnet.com

Credible

Speculation

Anecdotal Evidence

Generalization

Stacking the Deck

Appeal to Authority

Straw Man

Slippery Slope

Emotional Appeal

Red Herring

False Dilemma

Illogical

Moral Equivalency

Ad Hominem

Correlation w/o Causation

Semantics

Begging the Question

Faulty Analogy

Non Sequitur

Bandwagon

Dogmatism

Failing Occam's Razor

Biased

Pure Opinion

Hit Piece

Racial Bias

National Bias

Religious Bias

Financial Incentive

Political Agenda

Gender Bias

Misused Image/Video

Study Misinterpreted

Mistake

Misused Term

Science Misrepresented

Factual Error

Satire

Surface Level

Lack of Reliable Sources

Sensational

Not Credible

Investigative

Balanced

Well Sourced

Great Context

sports

entertainment

U.S.

international

business

technology

science

culture

politics

media

health

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS