CVE-2017-5249

Name: CVE-2017-5249
Creator: NVD / NIST
Published: 2018-02-22T16:29:00.28+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.71%

Last modified Jun 17, 2026

CVE-2017-5249 is a vulnerability of currently unknown severity. In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.. EPSS estimates a 0.71% chance of exploitation in the next 30 days.

Description

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.

Metrics

EPSS Probability

0.71%

48.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Wink	Wink	<= 6.1.0.19

References

https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/Third Party Advisory
https://blog.rapid7.com/2017/09/22/multiple-vulnerabilities-in-wink-and-insteon-smart-home-systems/Third Party Advisory

Timeline

Published: Feb 22, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-5249?

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.

How severe is CVE-2017-5249?

Severity scoring for CVE-2017-5249 is pending analysis. The EPSS model estimates a 0.71% probability of exploitation in the next 30 days.

How do I fix CVE-2017-5249?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-5249?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST