Cybersecurity researcher Eaton Zveare discovered that Jacuzzi’s smart hot tubs exposed owner data, leaving it vulnerable to malicious actors accessing the information.<\/p>\n
Zveare was the first to document the issue on his website<\/a><\/strong>, explaining that when he first tried to set up his account on the site linked to the smart hot tub app.<\/p>\n He was presented with an unauthorised access error message when he tried to sign in with the credentials he had set through the app.<\/p>\n “Right before that message appeared, I saw a header and table briefly flash on my screen. Blink, and you’d miss it. I had to use a screen recorder to capture it,” Zveare said.<\/p>\n “I was surprised to discover it was an admin panel populated with user data.”<\/p>\n A quick look at the data revealed that it contained information about owners of several smart hot tub brands.<\/p>\n Zveare then downloaded the JavaScript bundle for the architecture on which the website was built and searched for instances of “unauthorised”.<\/p>\n He found that the site checks if the user is an admin, and if they aren’t, they are redirected to the unauthorised error message.<\/p>\n Zveare determined that he may be able to block the unauthorised message “if the HTTP response could be intercepted to add in the missing Admin role”.<\/p>\n “I used Fiddler to modify the HTTP response accordingly, and I was finally able to access the admin panel in full,” Zveare said.<\/p>\n This gave the cybersecurity researcher unrestricted access to the admin panel, where he could view owner names and email addresses and even remove their ownership data entirely.<\/p>\n Zveare found a second admin panel while reviewing the Android app APK, where he found product, dealer, registered phone, and app log data.<\/p>\n After sending multiple emails to Jacuzzi without response, the admin panels were quietly secured after being vulnerable for months.<\/p>\n Cybersecurity researcher Eaton Zveare managed to access vulnerable hot tub owner data.<\/p>\n","protected":false},"author":341076,"featured_media":449948,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[79234,79240,79236,79238],"class_list":["post-449946","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-eaton-zveare","tag-exposed-data","tag-jacuzzi","tag-smart-hot-tubs"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/449946"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341076"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=449946"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/449946\/revisions"}],"predecessor-version":[{"id":450082,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/449946\/revisions\/450082"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/449948"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=449946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=449946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=449946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nNow read: Adobe Acrobat blocks anti-virus from scanning PDFs<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"