You do not have permission to edit this page, for the following reasons:
==Device Overview== * Manufacturer: Ring (Amazon) * Model Number: Video Doorbell 2 * Firmware Versions affected: 1.4.3 and older * Use-case: Battery-powered doorbell with motion detection, visitor alert, two-way audio. ==Vulnerabilities & Attack Surface== * CVE ID: CVE-2020-25699 * Vulnerability description: Weak token validation during Wi-Fi provisioning. Adjacent attackers can hijack setup flow. * Attack vector: Adjacent Wi-Fi during pairing phase. ==CIA Triad Impact Analysis== * Confidentiality: Wi-Fi credentials and live visitor footage can be intercepted. * Integrity: Attacker binds doorbell to their own Ring account. * Availability: Malicious provisioning packets put device into boot loop. ==Mitigations / Countermeasures== * 1. Upgrade firmware to latest Ring version. * 2. Complete pairing in private network, avoid public Wi-Fi. * 3. Enable two-factor authentication on Ring account. * 4. Change Wi-Fi password after new device pairing. ==References== [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25699 [2] Ring security bulletin
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
