Description
A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Lightspeed Lightspeed Classroom
Default version status: unknown
5.1.2.1763770643affected
References
- https://tasty-hovercraft-9b9.notion.site/Enabling-Unauthorized-Remote-Control-of-Student-Devices-with-Lightspeed-Classroom-2ec5157f5b4a800c9eefc5526479820a ↗
- https://www.incognitotgt.me/blog/lightspeed ↗
- https://truekas.dev/blog/lightspeed ↗
- https://www.lightspeedsystems.com/products/lightspeed-classroom-management/ ↗
- https://github.com/truekas/ls-poc ↗