By 
According to research, spiteful actors could exploit serious security flaw in a peer-to-peer (P2P) communications technology used across millions of internet of things (IoT) devices.
Security researcher Paul Marrapese originally stated the susceptibilities to the device vendor on January 15, 2019, but did not receive any response. And the vendor too did not respond to the second or third advisory notices with intent to reveal. The serious faults were openly revealed on April 24.
iLnkP2P, developed by China-based Shenzhen Yunni Technology Company, Inc., gives consumers an easy way to access their IoT devices remotely from a phone or computer by entering a serial number known as a UID. Nevertheless, it was discovered that the software contained two main weaknesses.
CVE-2019-11219, the first bug, is a listing fault that lets invaders discover devices that are online, then connect to them while sidestepping firewall restrictions.
CVE-2019-11220, the second flaw, a verification weakness that lets remote actors seize user-to-device traffic such as video streams and device identifications in clear text. Attackers could then use this capability to perform man-in-the-middle (MITM) attacks through which they could snip credentials and take over devices.
Marrapese says he formerly got in touch with numerous affected device vendors and iLnkP2P’s makers, as well as China’s CERT (on April 1 via the U.S.-based CERT/CC), but no one responded. The flaws remain unpatched to this day.
Marrapese wrote that the nature of these susceptibilities makes them very difficult to remediate for several reasons, adding that software-based remediation is improbable due to the infeasibility of changing device UIDs, which are enduringly allocated during the manufacturing process.
Instead of waiting for a patch, Marrapese recommends buying new devices from a trustworthy vendor or, failing that, obstructive outbound traffic to UDP port 32100.