PT-2018-13439 · Ismartalarm · Ismartalarm

Francesco Servida · Publicado 2018-11-20 · Atualizado 2019-10-03 · CVE-2018-16222

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iSmartAlarm application versions through 2.0.8 for Android

Description The issue concerns the storage of credentials in cleartext within the iSmartAlarmData.xml configuration file. This allows an attacker to retrieve the username and password.

Recommendations For versions through 2.0.8, update to a version that fixes the cleartext storage of credentials to prevent unauthorized access to user credentials.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-16222

Produtos afetados

Ismartalarm

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16222 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16222 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Nov/2 · Nota
• http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html · Nota