Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

360fly 4K camera lets anyone change Wi‑Fi settings

CVE-2017-8403 · published 9 years ago
Summary

The 360fly 4K camera firmware lets a person connect via Bluetooth and modify the Wi‑Fi password or take full control without any login. This can be done using the phone app or a standard Bluetooth tool. Update the camera to the latest firmware or disable Bluetooth pairing when not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
360fly 4k_camera_firmware 2.1.4
cpe:2.3:o:360fly:4k_camera_firmware:2.1.4:*:*:*:*:*:*:*
Original advisory text
360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is available at any time and does not require...
360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is available at any time and does not require a password. This affects firmware 2.1.4. Exploitation can use the 360fly Android or iOS application, or the BlueZ gatttool program.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published1 May 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-8403 · NVD
Track software like this
Free during beta