CVE-2019-5633 Hickory Smart Lock Insecure Storage on iOS
Attackers can access sensitive lock control data from the app's insecure local storage, potentially allowing remote control of smart locks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5633?
CVE-2019-5633 is a medium-severity vulnerability in Belwith Products, LLC Hickory Smart, published on 22 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for iOS, version 01.01.07 and prior versions.
Weakness: CWE-922
Which versions are affected by CVE-2019-5633?
It affects 1 product.
Products include Belwith-Keeler Hickory Smart.
How do I fix CVE-2019-5633?
No fix has been published for CVE-2019-5633 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5633 being exploited?
There is no known exploitation of CVE-2019-5633 in the wild and no public exploit code.
Other vulnerabilities in Belwith Products, LLC Hickory Smart
Sources
Also known as GHSA-hgpw-xp2q-8fwh.