News for hackers. Stuff that matters.

A comment on Breaking into apartment buildings in five minutes on my phone. Parent comment

Re:Breaking into apartment buildings in five minutes on my p... by cadamsdotcom on Monday February 24, 2025 @07:55PM (#43166809)
Not shining a spotlight is worse. The important thing is providing time to address the found vulnerability, ie. responsible disclosure. For which OP has indeed provided a timeline.

The debate has long since been settled comprehensively in favor of openness.

[ Parent | on HN ]
Re:Breaking into apartment buildings in five minutes on my p... by azinman2 on Monday February 24, 2025 @08:53PM (#43167161)
2025-01-30: Hirsch asked for an update as to whether clients running vulnerable systems have been alerted (no response as of publication)

2025-02-14: CVE-2025-26793 assigned

2025-02-15: publication

So two weeks after they don’t respond what they’re going to do with their clients this gets published? I’d hardly call that responsible.

[ Parent | on HN ]
Re:Breaking into apartment buildings in five minutes on my p... by shawabawa3 on Tuesday February 25, 2025 @06:56AM (#43170806)
I don't know why you picked a random date 2 weeks before publication instead of the relevant one:

2024-12-27: Current vendor of MESH identified as Hirsch (subsidiary of Vitaprotech Group) and contacted

They were contacted 7 weeks before publication

and

2025-01-11: Hirsch product security responds requesting details and are asked if they intend to alert clients

They responded 5 weeks before publication, and so were aware of the issue for at least 5 weeks before it was disclosed, during which time they did nothing about it

[ Parent | on HN ]
Re:Breaking into apartment buildings in five minutes on my p... by emmelaich on Wednesday February 26, 2025 @03:36AM (#43181917)
https://nvd.nist.gov/vuln/detail/CVE-2025-26793

"Awaiting Analysis This vulnerability is currently awaiting analysis."

[ Parent | on HN ]