CVE-2022-37193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-37193
Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.

7.4 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://chipolo.net/en-us/products/chipolo-one-4-pack Product
https://chipolo.net/en-us/products/chipolo-one-4-pack Product
https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md Third Party Advisory
https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:chipolo:chipolo:4.13.0:*:*:*:*:iphone_os:*:*
cpe:2.3:h:chipolo:chipolo_one:-:*:*:*:*:*:*:*
History

22 May 2025, 14:15

Type Values Removed Values Added
References (MISC) https://chipolo.net/en-us/products/chipolo-one-4-pack - Product () https://chipolo.net/en-us/products/chipolo-one-4-pack - Product
References (MISC) https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md - Third Party Advisory () https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md - Third Party Advisory
Information

Published : 2022-09-27 23:15

Updated : 2025-05-22 14:15

NVD link : CVE-2022-37193

Mitre link : CVE-2022-37193

JSON object : View

Products Affected

chipolo

  • chipolo
  • chipolo_one
CWE
CWE-522

Insufficiently Protected Credentials