PT-2019-17795 · Hickory · Hickory Smart Ethernet Bridge

Published 2019-08-22 · Updated 2020-10-16 · CVE-2019-5635

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hickory Smart Ethernet Bridge (affected versions not specified)

Description A cleartext transmission of sensitive information issue is present, where the device communicates over the network to an MQTT broker without using encryption, exposing the default username and password used to authenticate to the MQTT broker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-5635

Affected Products

Hickory Smart Ethernet Bridge

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-5635 · Security Note
• https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities · Note
• https://hickoryhardware.com/products/hickory-smart-ethernet-bridge?variant=20882150228086 · Note