PT-2018-13439 · Ismartalarm · Ismartalarm

Francesco Servida · Published 2018-11-20 · Updated 2019-10-03 · CVE-2018-16222

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iSmartAlarm application versions through 2.0.8 for Android

Description The issue concerns the storage of credentials in cleartext within the iSmartAlarmData.xml configuration file. This allows an attacker to retrieve the username and password.

Recommendations For versions through 2.0.8, update to a version that fixes the cleartext storage of credentials to prevent unauthorized access to user credentials.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-16222

Affected Products

Ismartalarm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16222 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16222 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Nov/2 · Note
• http://packetstormsecurity.com/files/150165/QBee-Camera-iSmartAlarm-Credential-Disclosure.html · Note