CVE-2019-12763: Insecure data storage security camera CZ

CVE

CVE-2019-12763

Vulnerable software

Android App: Security Camera CZ <= 1.6.8

Vulnerability

Insecure data storage(M2, OWASP Mobile Top 10, 2016).

Timeline

• 28.05.2019 Seller informed
• 05/29/2019 The manufacturer is trying to fix this issue with the next version.
• 29.05.2019 Disclosure

Description

The Security Camera CZ application up to 1.6.8 saves images of the recorded videos to the external data storage.
These images could contain very sensitive and personal data, as they are often used as a webcam or baby cam.
The external data storage can be written and read by any other app on the device.
This could lead to very sensitive data being exposed by a malicious app.

References:

• OWASP Mobile Top 10 (2016)
• OWASP The Mobile Security Testing Guide, External Data Storage