CVE-2019-12821

A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.

• CWE-330

• https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
• https://www.kth.se/polopoly_fs/1.914058.1561621210%21/Olsson_Larsson-Forsberg_vacuum.pdf

Published

Jul 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12816Modules.cpp in ZNC before 1.7.4-rc1 allows remote authentica…
• CVE-2019-12817arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel b…7
• CVE-2019-12818An issue was discovered in the Linux kernel before 4.20.15. …
• CVE-2019-12819An issue was discovered in the Linux kernel before 5.0. The …
• CVE-2019-1282An information disclosure exists in the Windows Common Log F…5.5
• CVE-2019-12820A vulnerability was found in the app 2.0 of the Shenzhen Jis…
• CVE-2019-12822In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5…
• CVE-2019-12823Craft CMS before 3.1.31 does not properly filter XML feeds a…6.1
• CVE-2019-12825Unauthorized Access to the Container Registry of other group…4.3
• CVE-2019-12826A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_…
• CVE-2019-12827Buffer overflow in res_pjsip_messaging in Digium Asterisk ve…
• CVE-2019-12828An issue was discovered in Electronic Arts Origin before 10.…