CVE-2019-15745

The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.

• CWE-798

• https://github.com/iamckn/equesExploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-four/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-one/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-three/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-two/Exploit, Third Party Advisory
• https://github.com/iamckn/equesExploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-four/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-one/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-three/Exploit, Third Party Advisory
• https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-plug-part-two/Exploit, Third Party Advisory

Published

Aug 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1574Cross-site scripting (XSS) vulnerability in Palo Alto Networ…
• CVE-2019-15740An issue was discovered in GitLab Community and Enterprise E…5.3
• CVE-2019-15741An issue was discovered in GitLab Omnibus 7.4 through 12.2.1…9.8
• CVE-2019-15742A local privilege-escalation vulnerability exists in the Pol…7.8
• CVE-2019-15743The Sony Xperia Touch Android device with a build fingerprin…5.5
• CVE-2019-15744The Sony Xperia Xperia XZs Android device with a build finge…3.3
• CVE-2019-15746SITOS six Build v6.2.1 allows an attacker to inject arbitrar…9.8
• CVE-2019-15747SITOS six Build v6.2.1 allows a user with the user role of S…8.8
• CVE-2019-15748SITOS six Build v6.2.1 permits unauthorised users to upload …9.8
• CVE-2019-15749SITOS six Build v6.2.1 allows a user to change their passwor…6.5
• CVE-2019-1575Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS …8.8
• CVE-2019-15750A Cross-Site Scripting (XSS) vulnerability in the blog funct…6.1