Eaton Halo Home Android App Insecure Storage

The primary impact of CVE-2019-5625 is the potential for unauthorized access to a user's Halo Home account and associated data. An attacker gaining physical control of an Android device running a vulnerable version of the Halo Home app, or successfully installing a malicious application, can locate the plaintext OAuth tokens. These tokens can then be used to impersonate the legitimate user, granting the attacker access to view and modify the user's personal information stored on the Halo Home backend cloud service. This includes potentially controlling smart home devices managed through the app. The risk is amplified if the device is rooted or already compromised, as it simplifies the attacker's ability to locate and extract the sensitive tokens. While the vulnerability requires physical access or a malicious app installation, the ease of token extraction once access is gained makes it a significant concern.

Users of the Halo Home Android application who have not upgraded to version 1.11.0 or later are at risk. This includes individuals who rely on the app to manage their smart home devices and those who may be less vigilant about device security practices, such as using strong passwords and enabling device lock.

• android / app:

# Check for the existence of the cleartext token file (example path - may vary)
adb shell 'ls /sdcard/HaloHome/tokens.txt'

• android / app:

# Check app permissions for storage access
adb shell 'pm dump HaloHome | findstr "storage"'

• android / app:

# Check for suspicious processes with elevated privileges
adb shell 'ps -A | grep HaloHome'

1. 2019-05-22Disclosure

   disclosure

1. Reserviert2019-01-07
2. Veröffentlicht2019-05-22
3. Geändert2024-08-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2019-5625 is to immediately upgrade the Halo Home Android application to version 1.11.0 or later. This version addresses the vulnerability by securely storing OAuth tokens, preventing their exposure in plaintext. If upgrading is not immediately feasible, consider implementing device-level security measures such as enabling device encryption and requiring strong passwords or biometric authentication. Regularly review installed applications and remove any suspicious or unauthorized apps. Users should also be educated about the risks of installing apps from untrusted sources and the importance of keeping their devices secure. After upgrading, verify the fix by confirming that OAuth tokens are no longer stored in a plaintext file using a file explorer on the device.