CVE-2023-34625

ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time. Alternatively, an attacker with physical access to the device on which the Android app is installed, can obtain the latest BLE messages via the app logs and use them for opening the lock.

• CWE-294

• https://mandomat.github.io/2023-03-15-testing-mojobox-security/Exploit, Technical Description, Third Party Advisory
• https://packetstormsecurity.com/2307-exploits/mojobox14-replay.txtThird Party Advisory, VDB Entry
• https://www.whid.ninja/blog/mojobox-yet-another-not-so-smartlockExploit, Technical Description, Third Party Advisory
• https://mandomat.github.io/2023-03-15-testing-mojobox-security/Exploit, Technical Description, Third Party Advisory
• https://packetstormsecurity.com/2307-exploits/mojobox14-replay.txtThird Party Advisory, VDB Entry
• https://www.whid.ninja/blog/mojobox-yet-another-not-so-smartlockExploit, Technical Description, Third Party Advisory

Published

Jul 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34616An issue was discovered pbjson thru 0.4.0 allows attackers t…7.5
• CVE-2023-34617An issue was discovered genson thru 1.6 allows attackers to …7.5
• CVE-2023-3462HashiCorp's Vault and Vault Enterprise are vulnerable to use…5.3
• CVE-2023-34620An issue was discovered hjson thru 3.0.0 allows attackers to…7.5
• CVE-2023-34623An issue was discovered jtidy thru r938 allows attackers to …7.5
• CVE-2023-34624An issue was discovered htmlcleaner thru = 2.28 allows attac…7.5
• CVE-2023-34626Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users"…4.3
• CVE-2023-3463 All versions of GE Digital CIMPLICITY that are not adhering…9.8
• CVE-2023-34634Greenshot 1.2.10 and below allows arbitrary code execution b…7.8
• CVE-2023-34635Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to…9.8
• CVE-2023-34637A stored cross-site scripting (XSS) vulnerability in IsarNet…5.4
• CVE-2023-3464A vulnerability was found in SimplePHPscripts Classified Ads…6.1