CVE-2018-16242 – oBike Electronic Lock Bypass

https://notcve.org/view.php?id=CVE-2018-16242

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol. oBike depende de Hangzhou Luoping Smart Locker para bloquear bicicletas, lo que permite que los atacantes omitan el mecanismo de bloqueo mediante el uso de Bluetooth Low Energy (BLE) para reproducir texto cifrado en base a un nonce predecible empleado en el protocolo de bloqueo. oBike Electronic Lock suffers from an access control bypass vulnerability via a replay attack on a predictable nonce. • https://seclists.org/bugtraq/2018/Sep/30 • CWE-294: Authentication Bypass by Capture-replay •