PT-2018-8243 · Insteon · Insteon For Hub

Deral Heiland · Publicado 2018-02-22 · Atualizado 2019-10-09 · CVE-2017-5250

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Insteon for Hub Android app versions 1.9.7 and prior

Description: The issue concerns the insecure storage of the OAuth token used for authorizing user access. This token is not stored in an encrypted and secure manner, potentially exposing user data.

Recommendations: For versions 1.9.7 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-922

CWE-312

Identificadores relacionados

CVE-2017-5250

Produtos afetados

Insteon For Hub

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5250 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5250 · Aviso do Fabricante
• https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems · Nota