PT-2018-8242 · Smarthome · Wink

Deral Heiland · Published 2018-02-22 · Updated 2019-10-09 · CVE-2017-5249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wink - Smart Home Android app versions 6.1.0.19 and prior

Description: The issue concerns the storage of the OAuth token used for authorizing user access. Specifically, the token is not stored in an encrypted and secure manner.

Recommendations: For versions 6.1.0.19 and prior, consider updating the app to a version where the OAuth token is stored securely, if such a version is available. As a temporary workaround, restrict access to sensitive features that rely on the OAuth token until a secure version of the app is installed.

Fix

Insecure Storage of Sensitive Information

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-922

CWE-312

Related Identifiers

CVE-2017-5249

Affected Products

Wink

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5249 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5249 · Vendor Advisory
• https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems · Note