vulnwire
9.8crit

CVE-2017-5250

In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known

In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.

Exploit prediction (EPSS)

0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Insteon Insteon for Hub

Classification

Weakness
  • CWE-922 Insecure Storage of Sensitive Information
  • CWE-312 Cleartext Storage of Sensitive Information

References

  • blog.rapid7.com /2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.