Miniserver still has poor security

[Gast]

I contacted loxone directly but have not since gotten any response, so I am just going to leave this here:

Web security 101. But why give a shit right? Just keep telling people to use VPN, which is ridiculous. So if I want to open my garage door and wifi does not reach the front driveway, I have to spend 30-40 seconds logging in to my VPN? Are you serious? I love how they claim the miniserver is unhackable. Maybe it is unhackable, but not secure.

[da2001]

This was also really confusing for me. At the first time i´ve updated from 6.x to 7.x my user and password was submitted plain in the url query.

[Gast]

this is known for quite some time now, no idea if loxone can't or just won't fix this..
who claimed the MS is unhackable? look at:

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150227-0_Loxone_Smart_Home_Multiple_Vulnerabilities_v10.txt

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150514-0_Loxone_Smart_Home_Multiple_Vulnerabilities_part2_v10.txt

[Gast]

http://forum.loxone.com/cscz/satae-f...er-https.html# Here on the czech blog the "Loxonaut" claimed such. Just use google translate. I saw that audit, didnt noticve the part about plaintext authetication.