Students Spot Washing Machine App Flaw That Gives Out Free Cycles

Researchers at UCSC discovered and publicly disclosed an API security flaw in CSC ServiceWorks' CSC Go mobile app that allows remote commands to laundry machines (including initiating cycles without funds) and arbitrary account-balance manipulation; they demonstrated free cycles and the ability to add multimillion-dollar balances, reported the issue to the vendor without meaningful response, and say the vulnerability remains unpatched.