CVE-2019-5632 Hickory Smart Lock Insecure Storage on Android
Attackers can access sensitive lock control data from the app's insecure local database, potentially enabling unauthorized remote control of smart locks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5632?
CVE-2019-5632 is a medium-severity vulnerability in Belwith Products, LLC Hickory Smart, published on 22 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.
Weakness: CWE-922
Which versions are affected by CVE-2019-5632?
It affects 1 product.
Products include Belwith-Keeler Hickory Smart.
How do I fix CVE-2019-5632?
No fix has been published for CVE-2019-5632 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5632 being exploited?
There is no known exploitation of CVE-2019-5632 in the wild and no public exploit code.
Other vulnerabilities in Belwith Products, LLC Hickory Smart
Sources
Also known as GHSA-xhfc-wp5r-c2r5.