CSC Pay Mobile App Payment Authentication Bypass Vulnerability
Vulnerability
A payment authentication bypass vulnerability exists in the CSC Pay Mobile App version 2.19.4, allowing users to disable Bluetooth during a transaction and bypass payment authorization. This could lead to unauthorized use of laundry services without payment. The vulnerability has been fixed in version 2.20.0.
Impact
Exploitation of this vulnerability allows users to use laundry services without payment, potentially leading to financial loss for the service provider.
Reproduction
To reproduce this vulnerability, initiate a payment through the CSC Pay Mobile App by scanning the QR code on a laundry machine. Before the app completes the Bluetooth authentication and processes the payment, disable Bluetooth. The laundry machine will start the cycle without charging for the service.
Remediation
Users can update to CSC Pay Mobile App version 2.20.0 to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.