CVE-2019-5034

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this...

CVE-2019-5034

CVE-2019-5034 affects Nest Cam IQ Indoor (firmware version 4620002) in the Weave Legacy Pairing functionality. Cisco Talos reports an exploitable information disclosure: a crafted Weave packet can trigger an out-of-bounds read, leaking memory contents. The vulnerability stems from a lack of bound...

CVE-2019-5040

An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send ...

CVE-2019-5040

CVE-2019-5040 is a confirmed vulnerability in Openweave-core 4.0.2 and Nest Cam IQ Indoor 4620002: the Weave MessageLayer DecodeMessageWithLength can mis-handle message length, enabling an integer overflow that leads to PacketBuffer data reuse and potential information disclosure. The TALOS advis...

CVE-2019-5037

CVE-2019-5037 affects Nest Cam IQ Indoor (4620002) WeaveCASEEngine::DecodeCertificateInfo. The issue is an integer overflow in the Weave certificate processing that allows an attacker to set CertInfoLength to 0xFFFF, causing the TLVReader to advance beyond the packet into unmapped memory and cras...

CVE-2019-5037

An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of Nest Cam IQ Indoor camera, version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur, resulting in a denial of servic...

Google Nest Security Cam Bugs Allow Device Takeover

Multiple vulnerabilities in Google’s Nest Cam IQ connected indoor security camera would allow an attacker on the same network to take over the device, execute code on it and/or take it offline. Nest Labs’ Cam IQ Indoor integrates security-enhanced Linux in Android, Google Assistant and facial...

Vulnerability Spotlight: Multiple bugs in OpenWeave and Nest Labs Nest Cam IQ indoor camera

Lilith Wyatt and Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Cisco Talos recently discovered multiple vulnerabilities in the Nest Cam IQ Indoor camera. One of Nest Labs’ most advanced internet-of-things devices, the Nest Cam IQ Indoor integrates Security-Enhanced Linux in...

Nest Labs Nest Cam IQ Indoor Weave TCP connection denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrestricted resource allocation, resulting in a denial of service. An attacker can connect multiple times to trigger this vulnerability...

Nest Labs Nest Cam IQ Indoor Weave PASE pairing brute force vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An...

Nest Labs Nest Cam IQ Indoor Weave Legacy Pairing Information Disclosure Vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigge...

Nest Labs Nest Cam IQ indoor Weave CASE nlWeaveCertificate authentication bypass vulnerability

Talos Vulnerability Report TALOS-2019-0811 Nest Labs Nest Cam IQ indoor Weave CASE nlWeaveCertificate authentication bypass vulnerability August 19, 2019 CVE Number CVE-2019-5044 Summary An exploitable certificate authentication vulnerability exists in the Weave CASE Pairing function of the Nest...

Nest Labs Nest Cam IQ Indoor WeaveCASEEngine::DecodeCertificateInfo denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of the Nest Cam IQ Indoor camera, version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur, resulting in a deni...

Nest Labs Nest Cam IQ Indoor Weave KeyError denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a...

Nest Labs Openweave Weave DecodeMessageWithLength Information Disclosure Vulnerability

Summary An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker c...

Infinova Swann SWWHD-INTCAM-HD Trust Management Issues Vulnerability

The Infinova Swann SWWHD-INTCAM-HD is a webcam from Infinova USA. A vulnerability with trust management issues exists in the Infinova Swann SWWHD-INTCAM-HD device. The vulnerability stems from the lack of an effective trust management mechanism in the network system or product. An attacker can...

VulnCheck KEV: CVE-2017-5173

An Improper Neutralization of Special Elements in an OS command issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call...

Geutebrück G-Cam and G-Code Cross-Site Scripting Vulnerabilities

G-Cam is a series of webcams from Geutebrück.G-Code is an analog video encoder from Geutebrück. A cross-site scripting vulnerability exists in Geutebrück G-Cam and G-Code. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker can exploit the...

Geutebrück G-Cam and G-Code OS Command Injection Vulnerabilities

G-Cam is a series of webcams from Geutebrück.G-Code is an analog video encoder from Geutebrück. An OS command injection vulnerability exists in Geutebrück G-Cam and G-Code. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc. from...

Geutebrück G-Cam and G-Code OS Command Injection Vulnerabilities

G-Cam is a series of webcams from Geutebrück.G-Code is an analog video encoder from Geutebrück. An OS command injection vulnerability exists in Geutebrück G-Cam and G-Code. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc. from...