PT-2019-17795 · Hickory · Hickory Smart Ethernet Bridge

Publicado 2019-08-22 · Atualizado 2020-10-16 · CVE-2019-5635

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hickory Smart Ethernet Bridge (affected versions not specified)

Description A cleartext transmission of sensitive information issue is present, where the device communicates over the network to an MQTT broker without using encryption, exposing the default username and password used to authenticate to the MQTT broker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2019-5635

Produtos afetados

Hickory Smart Ethernet Bridge

Referências · 3

• https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities · Nota
• https://hickoryhardware.com/products/hickory-smart-ethernet-bridge?variant=20882150228086 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5635 · Nota de Segurança