Cryptographic issues in Java SDK for Azure IoT - CVE-2019-0729
Published: February 13, 2019
Vulnerability identifier: #VU17651
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-0729
CWE-ID: CWE-310
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Java SDK for Azure IoT
Java SDK for Azure IoT
Detailed vulnerability description
The vulnerability allows a remote attacker to elevate privileges on the device.
The vulnerability exists due to Azure IoT Java SDK generates predictable symmetric keys for encryption. An attacker can derive the keys from the way they are generated and use them to access a user's IoT hub.
How to mitigate CVE-2019-0729
Install updates from vendor's website.