PT-2019-17786 · Blink · Halo Home

Rapid7 Researcher · Published 2019-05-22 · Updated 2020-10-16 · CVE-2019-5625

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Halo Home versions prior to 1.11.0

Description The issue allows an attacker to impersonate a legitimate user by reusing stored OAuth authentication and refresh access tokens. These tokens are stored in a clear text file, which remains until the user logs out and reboots the device. An attacker could exploit this to view and change the user's personal information in the backend cloud service, but would first need to gain physical control of the Android device or compromise it with a malicious app.

Recommendations For versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue. As a temporary workaround, consider regularly logging out of the application and rebooting the device to minimize the persistence of stored OAuth tokens. Restrict access to the device and use caution when installing applications to reduce the risk of compromise.

Exploit

Fix

Insufficiently Protected Credentials

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-922

Related Identifiers

CVE-2019-5625

Affected Products

Halo Home

References · 4

• 🔥 https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed · Exploit
• https://osv.dev/vulnerability/CVE-2019-5625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5625 · Security Note
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/CVE-2019-5625-Halo-home-smart-lighting-vulnerability-advisory.pdf · Note