# Pwning Millions of Smart Weighing Machines with API and Hardware Hacking

Withings WBS06 API association logic let an attacker bind any device ID to their own account by reusing their user session token as both Session-Id and sessionidtoken.

- Payout: Research
- Severity: critical
- Program: Withings
- Write-up by: Eugene Lim
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/pwning-millions-smart-weighing-machines-api-hardware-hacking/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-pwning-millions-smart-weighing-machines-api-hardware-hacking
- Tags: area:devices domain:api domain:iot impact:ato impact:data-leak kind:research platform:research sev:critical technique:reverse-engineering technique:source-review vuln:access-control vuln:auth-bypass vuln:business-logic vuln:idor

**Target:** Smart weighing machine cloud API (wbs06-ws.withings.net) and OEM device API
**Root cause:** Association endpoint trusted the type of the sessionidtoken to decide flow direction but never verified that the body's userid/deviceid matched the authenticated Session-Id, so a user token in both fields satisfied the device-initiated branch.
**Steps:**
1. Obtain own user session token via app login.
2. Send association request with `Session-Id: USER_SESSION_TOKEN` and body `deviceid=TARGET_DEVICE_ID&sessionidtoken=USER_SESSION_TOKEN`.
3. Server sees targetSession.type=='user', takes device-initiated branch, and associates TARGET_DEVICE_ID to attacker's user ID without validating device ownership.
4. Iterate incrementing deviceid values to bind arbitrary devices.
**How found:** Reverse-engineered the Android app and device firmware (via UART shell and mTLS debug logs) to map the full association flow, then code-read the server validation logic and noticed the flow-direction check relied on token type rather than matching the body ID to the Session-Id.
**Exploitation:** Attacker authenticates with their own user session, supplies their own token as sessionidtoken and an arbitrary incrementing deviceid; server associates the victim device to attacker account, granting remote control and health data access across an estimated 1M+ devices.
**Escalation:** Enumerating incrementing device IDs scales single-account takeover to mass device hijacking.
**Insight:** When an endpoint supports two mirrored flows (user-initiated vs device-initiated), check whether the branch selector is the token type alone; if the body's userid/deviceid is never compared to the authenticated session, you can satisfy the opposite branch with your own token.