AndFHEM: Exported Android components allow unauthorized FHEM commands
AndFHEM 2.4.1, an Android client for the FHEM home-automation server, exports two components without a permission check. Any app installed on the same device can send commands to the configured FHEM server, using the stored credentials of the user. The attack requires no user interaction, but the victim must have configured an FHEM server.
klassm · AndFHEM
