CVE-2019-5634 MEDIUM

CVE-2019-5634: Hickory Smart Lock Insecure Logging on Android

Vendor Belwith Products, Llc
Product Hickory Smart
Weakness CWE-532 · Sensitive info in logs
Published August 22, 2019
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.

Key dates

02Disclosure timeline

August 22, 2019 CVE published
September 17, 2024 Record updated