9.0
Critical
CVE-2019-5035 An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ…
Description
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker can send specially crafted packets to trigger this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Nest Labs | Versions not published |
Other CVEs of Nest Labs
The 8 CVEs of Nest Labs →
CVE-2019-5043
An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002
5.3
Medium
CVE-2019-5036
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ…
7.5
High
CVE-2019-5034
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ…
5.3
Medium
CVE-2019-5040
An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version…
8.2
High