PT-2024-14837 · Genie Company · Aladdin Connect Mobile Application

Deral Heiland · Published 2024-01-03 · Updated 2024-01-10 · CVE-2023-5879

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Genie Company Aladdin Connect Mobile Application versions 5.65 Build 2075 and below

Description The issue concerns the storage of users' product account authentication data in clear text within the application. This allows an attacker with access to the Android device to potentially retrieve users' clear text authentication credentials.

Recommendations For versions 5.65 Build 2075 and below, consider updating to a newer version that addresses the issue of storing authentication data in clear text, as this would mitigate the risk of credential exposure. As a temporary workaround, restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2023-5879

Affected Products

Aladdin Connect Mobile Application

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-5879 · Security Note
• https://rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5879 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1742661935718334522 · Twitter Post
• https://twitter.com/CVEnew/status/1742627830012444801 · Twitter Post
• https://t.me/cvenotify/66952 · Telegram Post
• https://t.me/cibsecurity/74341 · Telegram Post
• https://t.me/cvenotify/66144 · Telegram Post