Loading vulnerability…
Magic Home Pro 1.5.1 for Android contains an authentication-bypass vulnerability in its username-and-password authentication mechanism. An attacker can enumerate values to forge a user-specific token without knowing that user's correct password, enabling access to the application as the victim user.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a full exploit chain for CVE-2020-27199, an authentication bypass in the Magic Home Pro mobile application (used for JadeHomic LED Strip RGB Kits). The exploit consists of four main Python scripts: - magichome-forge.py: Forges JWT tokens with the 'None' algorithm, allowing authentication bypass by crafting tokens with arbitrary user and device IDs. - magichome-sniffer.py: Scans the local network for Magic Home Pro devices by sniffing for MAC addresses with the OUI 'C8:2E:47', and can perform MITM attacks to enumerate devices. It can also authenticate to the API and send ON/OFF commands to devices using forged tokens. - magichome-switch.py: Authenticates to the Magic Home Pro API and allows the user to send ON/OFF commands to a specified device MAC address using a valid or forged token. - magichome-takeover.py: Uses a forged token to send a request to the API endpoint /app/shareDevice/ZG001, adding the victim's device to the attacker's account, effectively taking over the device. The exploit targets the Magic Home Pro cloud API at wifij01us.magichue.net, using endpoints such as /app/getBindedUserListByMacAddress/ZG001, /app/sendCommandBatch/ZG001, and /app/shareDevice/ZG001. The attack requires the attacker to enumerate valid device MAC addresses (via local sniffing or other means), forge JWT tokens, and interact with the API to control or take over devices. The repository is well-documented, with a detailed README explaining the vulnerability, attack steps, and references. The exploit is operational, providing working code for enumeration, token forging, device control, and account takeover.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.