CVE-2019-5634 Hickory Smart Lock Insecure Logging on Android
Attackers can read sensitive Bluetooth and API communication logs from the Android device's external storage without root access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5634?
CVE-2019-5634 is a medium-severity vulnerability in Belwith Products, LLC Hickory Smart, published on 22 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.
Weakness: CWE-532
Which versions are affected by CVE-2019-5634?
It affects 1 product.
Products include Belwith-Keeler Hickory Smart.
How do I fix CVE-2019-5634?
No fix has been published for CVE-2019-5634 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5634 being exploited?
There is no known exploitation of CVE-2019-5634 in the wild and no public exploit code.
Other vulnerabilities in Belwith Products, LLC Hickory Smart
Sources
Also known as GHSA-23qf-p445-3vhr.