bugtraq - CVE-2015-1600 - Netatmo Weather Station Cleartext Password Leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201502131936.t1DJa5pn006595@sf01web3.securityfocus.com>
Date: Fri, 13 Feb 2015 19:36:05 GMT
From: jullrich@...s.edu
To: bugtraq@...urityfocus.com
Subject: CVE-2015-1600 - Netatmo Weather Station Cleartext Password Leak

Summary

   During initial setup, the weather station will submit its complete configuration unencrypted to the manufacturer cloud service. This configuration includes confidential information like the user's Wifi password.

   The problem has been fixed by removing this configuration dump from current firmware versions.

CVE: CVE-2015-1600.

Affected Systems: Netatmo Indoor Module firmware 100 and earlier.

Additional Details: https://isc.sans.edu/forums/diary/Did+You+Remove+That+Debug+Code+Netatmo+Weather+Station+Sending+WPA+Passphrase+in+the+Clear/19327/

Manufacturers web site: www.netatmo.com

Patch: Affected systems will download updated firmware automatically from Netatmo's cloud service.