CVE-2019-5035

State: Published
Severity: 9.0 Critical
Published: Aug 20, 2019
Updated: Aug 4, 2024
Reserved: Jan 4, 2019

Description

An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker can send specially crafted packets to trigger this vulnerability.

Scores

CVSS	Score	Vector	Source
3.0	9.0 Critical	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	talos

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

Product	Versions
Nest Labsn/a	Nest Labs Nest Cam IQ Indoor version 4620002Affected

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0798

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.