CVE-2020-6653 - Sensitive date stored in logcat file

Back Back to CVE browser

LOW

Sensitive date stored in logcat file

Published Aug 12, 2020

3.9

LOW

CVSS 3.1

EPSS 0.26%

Description

Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information to monitor and control the user's account and associated devices.

Affected products

Vendor Eaton Product Secure Connect Mobile App Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.7.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Eaton

Secure Connect Mobile App

n/a

Version	Status	Constraints
unspecified	affected	<=1.7.3

Remediation

Vendor solution

Eaton has release a new version of the app v1.7.4. User's are recommended to update their apps.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-532

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27800
Advisory
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-vulnerability-advisory-secure-connect-mobile-app.pdf
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27800		Advisory
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-vulnerability-advisory-secure-connect-mobile-app.pdf		x_refsource_MISCVendor Advisory