VulnerabilityModified

CVE-2019-5034

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002.

MEDIUM 5.3EPSS 0.60%

Does this matter?

Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.

Description

An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vulnerability.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: google/nest cam iq indoor firmware
Source: talos-cna@cisco.com

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0797Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0797Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.