CVE-2022-37193

State: Published
Severity: 7.4 High
Published: Sep 27, 2022
Updated: May 22, 2025
Reserved: Aug 1, 2022

Description

Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://chipolo.net/en-us/products/chipolo-one-4-pack
https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.