CVE-2019-5634

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.

• CWE-532
• CWE-532

• https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/Third Party Advisory
• https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_USProduct
• https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/Third Party Advisory
• https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_USProduct

Published

Aug 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5627The iOS mobile application BlueCats Reveal before 5.14 store…7.8
• CVE-2019-5629Rapid7 Insight Agent, version 2.6.3 and prior, suffers from …7.8
• CVE-2019-5630A Cross-Site Request Forgery (CSRF) vulnerability was found …5.9
• CVE-2019-5631The Rapid7 InsightAppSec broker suffers from a DLL injection…7.8
• CVE-2019-5632An insecure storage of sensitive information vulnerability i…5.5
• CVE-2019-5633An insecure storage of sensitive information vulnerability i…5.5
• CVE-2019-5635A cleartext transmission of sensitive information vulnerabil…7.5
• CVE-2019-5636When a Beckhoff TwinCAT Runtime receives a malformed UDP pac…7.5
• CVE-2019-5637When Beckhoff TwinCAT is configured to use the Profinet driv…7.5
• CVE-2019-5638Rapid7 Nexpose versions 6.5.50 and prior suffer from insuffi…8.7
• CVE-2019-5640Rapid7 Nexpose versions prior to 6.6.114 suffer from an info…5.3
• CVE-2019-5641Rapid7 InsightVM suffers from an information exposure issue …5.3