Lucene search

Rapid7CVE-2019-5635

HistoryAug 22, 2019 - 2:15 p.m.

CVE-2019-5635

2019-08-2214:15:13

CWE-319

rapid7

web.nvd.nist.gov

cve-2019-5635

cleartext transmission

sensitive information

vulnerability

hickory smart ethernet bridge

belwith products

llc

mqtt

encryption

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without using encryption. This exposed the default username and password used to authenticate to the MQTT broker. This issue affects Hickory Smart Ethernet Bridge, model number H077646. The firmware does not appear to contain versioning information.

Affected configurations

Nvd

Node

belwith-keelerhickory_smart_ethernet_bridge_firmwareMatch-

AND

belwith-keelerhickory_smart_ethernet_bridgeMatch-

VendorProductVersionCPE
belwith-keelerhickory_smart_ethernet_bridge_firmware-cpe:2.3:o:belwith-keeler:hickory_smart_ethernet_bridge_firmware:-:*:*:*:*:*:*:*
belwith-keelerhickory_smart_ethernet_bridge-cpe:2.3:h:belwith-keeler:hickory_smart_ethernet_bridge:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
belwith-keeler	hickory_smart_ethernet_bridge_firmware	-	cpe:2.3:o:belwith-keeler:hickory_smart_ethernet_bridge_firmware:-:::::::*
belwith-keeler	hickory_smart_ethernet_bridge	-	cpe:2.3:h:belwith-keeler:hickory_smart_ethernet_bridge:-:::::::*

CNA Affected

[
  {
    "product": "Hickory Smart Ethernet Bridge",
    "vendor": "Belwith Products, LLC",
    "versions": [
      {
        "lessThanOrEqual": "H077646",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/

hickoryhardware.com/products/hickory-smart-ethernet-bridge?variant=20882150228086

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVE-2019-5635