CVE-2019-12820

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner.

• CWE-319

• https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
• https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf

Published

Jul 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12815An arbitrary file copy vulnerability in mod_copy in ProFTPD …9.8
• CVE-2019-12816Modules.cpp in ZNC before 1.7.4-rc1 allows remote authentica…
• CVE-2019-12817arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel b…7
• CVE-2019-12818An issue was discovered in the Linux kernel before 4.20.15. …
• CVE-2019-12819An issue was discovered in the Linux kernel before 5.0. The …
• CVE-2019-1282An information disclosure exists in the Windows Common Log F…5.5
• CVE-2019-12821A vulnerability was found in the app 2.0 of the Shenzhen Jis…
• CVE-2019-12822In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5…
• CVE-2019-12823Craft CMS before 3.1.31 does not properly filter XML feeds a…6.1
• CVE-2019-12825Unauthorized Access to the Container Registry of other group…4.3
• CVE-2019-12826A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_…
• CVE-2019-12827Buffer overflow in res_pjsip_messaging in Digium Asterisk ve…