Cisco Talos
has uncovered multiple vulnerabilities in the Nest Cam IQ Indoor camera that
can enable a denial of service situation or enable code execution for an
unauthorized user.Version 4620002
camera is affected by the vulnerabilities
and Cisco Talos has revealed and worked with the NEST team so a patch is available.The two most
critical issues are CVE-2019-5035, which holds a CVSS 9.0 rating and CVE-2019-5040,
CVSS 8.5.The first
issue is exploitable information disclosure vulnerability in the Weave PASE
pairing functionality camera which can be exploited by a set of specially
crafted weave packets that can brute force a pairing code, resulting in greater
Weave access and potentially full device control. This can be triggered when an
attacker sends specially crafted packets.CVE-2019-5040
can also be exploited through specially crafted weave packets. In this case an
exploitable information disclosure vulnerability exists in the Weave
MessageLayer parsing of Openweave-core version 4.0.2 and the Nest Cam resulting
in PacketBuffer data reuse enabling possible information disclosure.The less
critical vulnerabilities are:
- CVE-2019-5043 – a TCP connection denial-of-service vulnerability.
- CVE-2019-5034 – a pairing information disclosure vulnerability.
- CVE-2019-5036 – a denial-of-service vulnerability.
- CVE-2019-5037 – a denial-of-service vulnerability.
- CVE-2019-5038 - a code execution vulnerability.
- CVE-2019-5039 - code execution vulnerability.
