CVE-2020-11015

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be reviewed further. Applies to all (mostly ESP8266/ESP32) users. This has been fixed in firmware version 2.5.0.

• CWE-290
• CWE-290

• https://github.com/suculent/thinx-device-api/security/advisories/GHSA-5x54-39xq-cwvcThird Party Advisory
• https://github.com/suculent/thinx-device-api/security/advisories/GHSA-5x54-39xq-cwvcThird Party Advisory

Published

Apr 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1101A cross-site-scripting (XSS) vulnerability exists when Micro…5.4
• CVE-2020-11010In Tortoise ORM before versions 0.15.23 and 0.16.6, various …8.8
• CVE-2020-11011In Phproject before version 1.7.8, there's a vulnerability w…8.8
• CVE-2020-11012MinIO versions before RELEASE.2020-04-23T00-58-49Z have an a…7.5
• CVE-2020-11013Their is an information disclosure vulnerability in Helm fro…5
• CVE-2020-11014Electron-Cash-SLP before version 3.6.2 has a vulnerability. …8.6
• CVE-2020-11016IntelMQ Manager from version 1.1.0 and before version 2.1.1 …8.8
• CVE-2020-11017In FreeRDP less than or equal to 2.0.0, by providing manipul…6.5
• CVE-2020-11018In FreeRDP less than or equal to 2.0.0, a possible resource …6.5
• CVE-2020-11019In FreeRDP less than or equal to 2.0.0, when running with lo…6.5
• CVE-2020-1102A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11020Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1…9.8