SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-5625

This vulnerability can allow an attacker to impersonate the legitimate user by reusing the stored OAuth token, thus allowing them to view and change the user's personal information stored in the backend cloud service.

HIGH 7.1EPSS 0.41%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by reusing the stored OAuth token, thus allowing them to view and change the user's personal information stored in the backend cloud service. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app.

CVSS 3.1
7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
0.41% probability · 35th percentile
Public exploits
None in Exploit-DB
CISA KEV
Not listed
Weakness
CWE-922, CWE-522
Affected
eaton/halo home
Source
cve@rapid7.com
EPSS trend
0%3%5%26 October 2026: 0.41%26 October 202626 October 2026

EPSS 0.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.